By Owais Sultan
As we progress further into digital life, PDF security has evolved increasingly complex.
This is a post from HackRead.com Read the original post: PDF Security – How To Keep Sensitive Data Secure in a PDF File

Dive into PDF security in the digital era and learn how tools like PDF Expert ensure data protection in electronic documents.

At present, in our digital era, protecting confidential data cannot be overstated. With an ever-increasing array of electronic documents like PDFs, protecting sensitive information has become even more critical. This article delves deep into safeguarding PDF files for confidential data — paying special consideration to PDF Expert as a leading tool in this domain.

****Understanding the Importance of PDF Security****

PDF Expert stands out as an industry leader among apps that allow you to edit pdf on iPhone and other Apple devices — offering intuitive PDF editing functions and sophisticated security measures essential for protecting confidential data.

Their universal compatibility across platforms makes PDFs the go-to document option. However, with widespread use comes responsibility in protecting confidential information, including proprietary business data, personal details, or sensitive financial information. This kind of data needs protection from being accessible by third parties.

****Utilize PDF Expert’s Power for Editing PDFs on iPhone & iPad****

PDF Expert has become renowned for its speed, reliability, and user-friendly interface. Not just limited to minor edits, PDF Expert allows users to make major alterations — editing text and adding links, redacting information, altering images, and even electronically signing documents. For business people in particular, quickly signing and sending contracts is often crucial.

****Advanced Security Features for Increased Protection****

*   **Text Recognition:** One of PDF Expert’s most impressive capabilities is Optical Character Recognition (OCR, also known as text recognition). OCR lets users recognize text from scanned documents to make searchable, highlightable, and editable text — something especially helpful when dealing with older PDFs or documents that haven’t yet been digitized.

*   **Enhance Scans:** Scanned documents from years past may not always look their best due to shadows, distortions, and other imperfections in their contents. PDF Expert’s AI-powered enhanced feature rectifies these problems so every PDF looks perfect regardless of where its origination may lie.

*   **Customization and Personalization:** PDF Expert recognizes that every user has individual requirements. Therefore, it offers customizable features that enable users to arrange their most utilized tools according to their workflow; an example of this is using multiple pens for annotations or quickly adding markup tools for fast access. These tools ensure that users can tailor this platform according to their specifications.

****Every Professional Needs the Appropriate Tool****

PDF Expert can meet the needs of educators, students, construction professionals, and managers across various industries.

****Evolution of PDF Security Solutions****

As we progress further into digital life, PDF security has evolved increasingly complex. Gone are the days when simple password protection would suffice — modern threats require advanced solutions like PDF Expert to combat them effectively.

****Encryption Is A First Line Of Defense****

Encryption is one of the cornerstones of PDF security, ensuring data contained within PDF documents remains unreadable to unauthorized users. Only those possessing a valid decryption key (typically a password) may access its contents; PDF Expert employs advanced algorithms for encryption that ensure your documents remain hidden from prying eyes.

****Redaction: Removing Sensitive Data****

At times, certain parts of a document need to be shared while keeping other sections — which contain sensitive data — confidential. With PDF Expert, redacting information is a seamless process that ensures once data has been redacted, it’s gone for good.

****Digital Signatures Provide Authenticity and Integrity Protection****

When PDF Expert is used to sign PDFs digitally, recipients receive assurances that documents have not been modified while also verifying the signer(s) identity.

****Access Control: Directing Who Views What****

PDF Expert’s features allow document creators to set user permissions, enabling you to determine who can view, edit, print, or copy from their PDF document — providing finely controlled access that ensures even though someone might possess your file, they might not necessarily gain full access.

****Keep Current With Threats With Regular Updates: Staying Abreast****

As digital threats emerge regularly, PDF Expert ensures its software is regularly updated with security patches to stay ahead of them and give its customers access to the safest version possible. PDF Expert’s software updates deliver new features and patch potential vulnerabilities for a safer experience. So, users always receive the safest versions possible of its applications.

****PDF Security and Compliance****

Compliance with data protection regulations has become essential across industries. PDF security has to comply with various regulations, ranging from compliance with trading and investment banking regulations to compliance with regulations like Europe’s General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), which mandate stringent data security measures for many organizations such as trading.

****How PDFs Fit Into Digital Workflows****

PDFs are indispensable in digital collaboration across various spheres — from contract negotiations to research. With increased reliance on PDF documents comes increased responsibility for maintaining their security at every point during their lifespan. PDF Expert’s suite of tools is tailored specifically towards this responsibility, guaranteeing documents remain protected whether in transit, at rest, or actively edited by staff members.

****Education of the Masses: Awareness Is Required****

PDF Expert provides advanced security features, but humans remain an insecure link in any security network. Therefore, users must be educated on the significance of PDF security best practices, including sharing unprotected documents without first understanding the risks involved, regularly updating software applications, and the need for unique passwords when encrypted.

****Future of PDF Security Solutions****

As technology progresses, so will the methods utilized by malicious actors. Artificial Intelligence, Quantum Computing, and other innovative solutions may present new risks to PDF security. However, with continuous innovation and commitment to staying ahead of the curve, tools like PDF Expert are prepared to face these threats head-on and provide robust protection.

****Accept Feedback and Improve continuously****

PDF Expert, as a user-centric tool, regularly solicits feedback from its user community to meet both current needs and anticipate any upcoming challenges and requirements. By regularly soliciting user input through this feedback loop, PDF Expert ensures it remains current while anticipating any foreseeable challenges or needs in its response to users.

****Conclusion****

PDF security in our increasingly digital world cannot be stressed enough. As physical and digital realms continue to merge, software providers and users must prioritize data protection. PDF Expert is leading this charge so we can hope for a future where our digital documents are as safe as their physical equivalents.

****_RELATED ARTICLES_****

1.  Editing Text in a PDF File
2.  Top 7 PDF Tools to Edit, Merge/Split and Protect PDF
3.  MalDoc in PDF Attack: Hackers Hiding Malicious Word Files within PDFs

PDF Security – How To Keep Sensitive Data Secure in a PDF File

By Deeba Ahmed
A large number of victims of these scams are unsuspecting users in India.
This is a post from HackRead.com Read the original post: Chinese Scammers Use Fake Loan Apps for Money Laundering

Beware of fake banking and loan apps that offer instant loans but, in reality, collect your Personal Identifying Information (PII) and financial data, while also requesting excessive permissions to access data on your phone.

The cybersecurity researchers at CloudSEK have found a new scam campaign in which Chinese scammers are targeting the Indian digital payment system using illegal instant loan apps. The scammers have lured thousands of victims, making false promises of substantial loans on easy instalments and after obtaining personal details and fees, they vanish. 

The researchers have identified that the reason why law enforcement agencies have been unable to trace their malicious activities is that scammers are using Chinese payment gateways and Indian money mules.

The campaign was discovered between 22nd July and 18th September 2023. The researchers claimed that there have been around 30,000 Adhaar cards and bank accounts have been breached, 40,000 devices compromised, and thousands of users have been tricked.

CloudSEK initiated an investigation on 8 September 2023 after identifying a malicious app advertised by cybercriminals. This app impersonated a well-known bank headquartered in Tamil Naidu, India recording a revenue of $23million. The fake domain name of the C2 server followed this pattern: .online.

Screenshot: CloudSEK

Further probing, according to CloudSEK’s report, revealed a sophisticated scam operation orchestrated by Chinese scammers. So far, scammers have collected more than INR 37 lakhs (equivalent to $46,000) via 55 malicious Android applications. The lure involved offering a loan of 641 crore INR. CloudSEK claims to have identified over 15 obscure payment gateways operated by Chinese scammers.

Their modus operandi relies on false promises in which scammers create fake loan apps and promote them for offering huge loans and flexible repayment packages. Victims are lured into giving away sensitive personal data, including name, phone number, bank account details, and address.

The malicious apps demand excessive permissions, prompting users to grant access to contacts, photos, and other sensitive information. The scammers vanish after extracting their desired information and receiving loan processing fees from the victims, typically 5% of the promised loan amount.

The entire campaign was difficult to track due to its transnational reach. However, it is worth noting that the scam is not confined to India; in fact, scammers are operating a vast network that spans multiple countries, including the following:

*   Brazil
*   Turkey
*   Mexico
*   Vietnam
*   Malaysia
*   Colombia
*   Indonesia
*   Philippines
*   South Africa

Moreover, scammers exploit regulatory gaps such as the UPI service providers (Unified Payments Interface) in India do not come under the PMLA (Prevention of Money Laundering Act) purview, which is a significant loophole that scammers are actively exploiting.

_“_A notable trend we’ve observed is scammers exploiting Chinese payment gateways due to their relative ease of use and limited regulatory scrutiny. These gateways offer a convenient bridge to funnel funds outside India, leveraging sophisticated techniques that blur jurisdictional lines, making it challenging to track and intercept the money trail,_“_ said Sparsh Kulshrestha, Senior Security Analyst at CloudSEK.

_“_This enables scammers to sidestep the legal and financial roadblocks, making it imperative for authorities to enhance cooperation and adopt advanced measures to counter this sophisticated threat,” added Kulshrestha.

The scammers have a robust money mule network where intermediaries receive funds from scammers and transfer them to other accounts for a commission ranging from 1% to 2% of the total transaction amount. Indian bank customers are the primary targets of this campaign. to entice potential money mules, scammers use several different tactics like face-to-face meetings and sponsored travel.

How it is done Screenshot: CloudSEK

An analysis of the fraudulent payment gateways revealed that money is transferred either through online (UPI) or offline (debit card) methods and distributed between multiple recipients. However, fraudsters maintain a presence within India to collect SIM cards and bank accounts for money laundering.

Mitigation efforts involve collaboration between banks and NPCI for enhancing security measures such as the verification of new mobile numbers added to bank accounts. In addition, organizations and regulatory bodies must remain informed about evolving scam tactics and devise reliable fraud detection and prevention measures.

Additionally, it is essential to strengthen UPI security, and service providers must consider additional security measures to protect users. Finally, common sense is your most effective defence against such scams, as the saying goes, “There’s no such thing as a free lunch.” Therefore, don’t anticipate receiving free loans without any consequences.

****_RELATED ARTICLES_****

1.  Hacker Leaks 73M Records from Indian HDFC Bank Subsidiary
2.  Indian Ticketing Platform RailYatri Hacked – 31 Million Impacted
3.  Chinese Spyware on Google Play Store Apps had 2M Downloads
4.  China’s insidious surveillance against Uyghurs with Android malware
5.  Covid antigen test results of 1.7m Indian, foreign nationals leaked online

Chinese Scammers Use Fake Loan Apps for Money Laundering

By Waqas
E-Root marketplace had its domain seized in 2020.
This is a post from HackRead.com Read the original post: E-Root Marketplace Admin Extradited to US on Computer Fraud Charge

E-Root sold access to compromised devices and had more than 350,000 compromised computer credentials for sale.

A man from Moldova, Sandu Diaconu (31), has been extradited to the United States to face charges related to his operation of the E-Root marketplace, a website that sold access to compromised computers worldwide.

It’s worth noting that the E-Root marketplace had its domain seized in 2020 following a coordinated operation by international law enforcement authorities.

On October 16, 2023, Diaconu was extradited from the UK and appeared in a federal court in Florida the following day. He is charged with conspiring to commit computer and access device fraud, wire fraud, money laundering, and additional computer and access device fraud. If found guilty on all counts, Diaconu could potentially face a maximum sentence of 20 years in prison.

The indictment alleges that Diaconu served as an administrator of the E-Root Marketplace, a website that provided access to compromised computers for an extended period, including servers owned by American businesses and individuals.

To safeguard the privacy of its administrators, customers, and vendors, the Marketplace implemented certain measures. Through E-Root, buyers could search for compromised computer credentials, such as RDP and SSH access, tailored to their preferences, including criteria like price, location, operating system, and internet service provider.

The Marketplace also utilized Bitcoin and the online payment service Perfect Money to conceal the money paid by customers. The platform additionally offered a conversion service between Bitcoin and Perfect Money through its separate cryptocurrency exchange, which was also seized by the authorities.

According to the DoJ’s press release, the Marketplace had over 350,000 compromised computer credentials available for sale. Victims spanned across multiple industries and regions, including various companies, businesses, and at least one local government agency.

Furthermore, several of the affected companies experienced Ransomware attacks with extensive ramifications for victims, and some of the pilfered credentials listed on the Marketplace were linked to tax fraud schemes involving stolen identities.

Domain Seizure Notice for E-Root.

The IRS-CI Cyber Crimes Unit in Washington, D.C., and the FBI-Tampa Division jointly spearheaded the investigation. Several key entities played a substantial role in this effort, including the Tampa Field Office of the IRS-Criminal Investigation, the Department of Justice’s Office of International Affairs, IRS-CI and FBI International Operations at Mission UK, the United Kingdom’s National Extradition Unit, the United Kingdom’s Central Authority, and the Tampa Field Office of the United States Marshals Service.

This case is a reminder of the growing threat of cybercrime and the importance of international cooperation in combating it. The United States Department of Justice is committed to working with its partners around the world to bring perpetrators of cybercrime to justice.

****_RELATED ARTICLES_****

1.  Finnish Dark Web Marketplace PIILOPUOTI Seized
2.  Student Ran Germany’s Largest Dark Web Market DiDW
3.  8 Online Best Dark Web Search Engines for Tor Browser
4.  179 Dark Web vendors arrested, 500kg worth of drugs seized
5.  Domain, server of DoubleVPN used by ransomware gangs seized

E-Root Marketplace Admin Extradited to US on Computer Fraud Charge

By Deeba Ahmed
It is unclear how long Cisco will take to release a patch.
This is a post from HackRead.com Read the original post: Cisco Web UI Vulnerability Exploited Massly, Impacting Over 40K Devices

The US had the most compromised devices (4,659) with a backdoor installed as a result of the Cisco Web UI vulnerability followed by the Philippines (over 3,200).

****_KEY FINDINGS_****

**Cisco released a security advisory on October 16 to warn users about a critical zero-day privilege escalation vulnerability in its IOS XE Web UI software.**

**As per Censys, the company tracking the vulnerability, by October 18 the number of infections had increased from the previously reported 34,140 to 41,983 hosts, while 34,140 had backdoor installed**

**It is tracked as CVE-2023-20198 and has been used to exploit tens of thousands of devices.**

**The US had the highest number of compromised devices followed by the Philippines.**

A critical cybersecurity threat disclosed by Cisco has resulted in mass exploitation of its devices, with the number of impacted systems surpassing 40,000 hosts worldwide. Nonprofit security group Shadowserver has detected over 32,800 devices compromised so far.

On the other hand, Censys has been tracking this vulnerability and in its blog post, the company explained that due to active exploitation of this security flaw tens of thousands of devices could be affected.

The company scanned the impacted Cisco devices and found that most belonged to telecom firms offering internet services to business and home users, including AT&T. The US had the highest number of compromised devices with a backdoor installed (4,659) followed by the Philippines (over 3,200).

Hackread.com had reported that the vulnerability, tracked as CVE-2023-20198, was discovered in the Cisco IOS XE software’s Web UI feature. Cisco warned customers about the vulnerability affecting Cisco RV320 and RV325 routers, explaining that it allows a remote unauthorized attacker to create an account on the compromised system with privilege level 15 access and go on to gain full control of the device. 

The vulnerability affects the IOS XE Software Web UI feature because it is enabled by default in the devices. Cisco recommends users disable the HTTP server feature on every internet-connected system to prevent exploitation. Attackers exploiting this flaw are hijacking routers from telecom firms. Cisco has confirmed that since at least mid-September, threat actors have been exploiting it as a zero-day.

The vulnerability was first discovered in March 2023, and an uptick in attacks exploiting it was observed from mid-September. Moreover, a highly sophisticated actor is suspected to be exploiting it, which hints at the launch of a targeted and coordinated campaign while Cisco is still working on a patch to fix it.

In its threat advisory published on October 16th, 2023, Cisco stated that the actor exploited the old, already patched vulnerability (CVE-2021-1435) to install the implant after obtaining access to the device.

> _“We have also seen devices fully patched against CVE-2021-1435 getting the implant successfully installed through an as-of-yet undetermined mechanism.”_
> 
> CISCO

It is a serious security threat as the vulnerability has the highest criticality score of 10. The IOS XE software is an essential component of Cisco switches, wireless controller products, and routers. The vulnerability is critical enough to enable a complete takeover of Cisco devices, granting threat actors the ability to effortlessly monitor network traffic or present phishing pages loaded with harmful malware.

Reportedly, 469 of the compromised devices were registered at AT&T for residential and business clients. The company uses enterprise-grade Cisco XE routers, so small-sized organizations and individuals would likely be vulnerable to this threat instead of large corporations.

The risks posed by the vulnerability are wide-ranging, as attackers can leverage access to compromised devices to disrupt network operations, steal sensitive data, and launch new attacks against other systems on the network.

It is unclear how long Cisco will take to release a patch. Meanwhile, users must scan their devices for infection and disable the HTTP server feature, implement network segmentation, and monitor network traffic for suspicious activity.

****_RELATED ARTICLES_****

1.  Cisco’s new tool will detect malware in encrypted traffic
2.  New 19 CISA Advisories Highlight Vulnerabilities in Top ICS Products
3.  New Akira Ransomware Targets Businesses via Exploited CISCO VPNs
4.  Ex-employee hacked Cisco’s AWS Infrastructure; erased virtual machines
5.  Unpatched Cisco Catalyst SD-WAN Manager Systems Exposed to DoS Attacks

Cisco Web UI Vulnerability Exploited Massly, Impacting Over 40K Devices

By Waqas
If you are a Casio ClassPad customer, it is strongly recommended that you change your ClassPad password immediately to protect yourself.
This is a post from HackRead.com Read the original post: Human Error: Casio ClassPad Data Breach Impacting 148 Countries

The breach was discovered on October 11, 2023, affecting 91,921 users in Japan and 35,049 customers from 148 countries and regions.

Casio has disclosed a data breach that impacted customers of its ClassPad education platform in 148 countries. The breach was discovered on October 11, 2023, while the person in charge was attempting to work within the development environment, a database failure was discovered, prompting the company to assess the situation.

Upon further analysis, it was also determined that on the evening of Thursday, October 12, unauthorized access had occurred, leading to the exposure of personal information of residents from countries outside Japan.

The exposed data includes customer names, email addresses, countries of residence, service usage details, and purchase information such as payment methods, license codes, and order specifics.

Casio stated that the hackers did not infiltrate systems beyond the compromised database within the development environment and that the ClassPad.net app remains operational.

> _“Customers in Japan: 91,921 items belonging to customers, including individuals and 1,108 educational institution customers – Customers outside Japan: 35,049 items belonging to customers from 148 countries and regions.”_
> 
> CASIO

****Human Error!****

In a data breach notification, Casio confirmed that the situation arose because certain network security settings within the development environment were unintentionally disabled due to an operational error within the responsible department, coupled with inadequate operational oversight. These factors are believed to have allowed an external party to gain unauthorized access.

The company is working with law enforcement authorities and has reported the incident to Japan’s Personal Information Protection Commission. Casio has also taken steps to secure the ClassPad platform and prevent future data breaches.

Roger Grimes, a Data-Driven Defense Evangelist at KnowBe4, commented on the breach, highlighting that it was indeed caused by human error. Grimes underscored the importance of employee cybersecurity training as a cornerstone for both small businesses and large corporations.

_“_This data breach was caused by human error which led to network and database compromise. It’s important that any changes impacting cybersecurity be reviewed prior to implementation and that all security settings be periodically reviewed for accuracy,_“_ said Grimes. _“_It shows the importance of change control and configuration control. These can be considered “boring topics” by some, but are must-haves if an organization is expected to stay secure as it can over the long run._“_

****What to Do If You Are a Casio ClassPad Customer****

If you are a Casio ClassPad customer, Casio recommends that you take the following steps to protect yourself:

1.  Change your ClassPad password immediately.
2.  Monitor your ClassPad account for any suspicious activity.
3.  Be wary of phishing emails or other scams that may attempt to exploit the data breach.

**What Casio is Doing to Address the Data Breach**

Casio has taken a number of steps to address the data breach, including:

*   Notifying affected customers of the data breach.
*   Working with law enforcement authorities to investigate the breach.
*   Securing the ClassPad platform and preventing future data breaches.
*   Reporting the incident to Japan’s Personal Information Protection Commission.

The Casio ClassPad data breach is a reminder that even large and well-established companies are vulnerable to cyberattacks. Customers of Casio ClassPad should take steps to protect themselves, such as changing their passwords and monitoring their accounts for suspicious activity.

****_RELATED ARTICLES_****

1.  Casio Electronics Taiwan Website Hacked
2.  Freecycle Data Breach Impacts 7 Million Users
3.  Casio China Hacked, 150,000 user accounts leaked
4.  IBM Notifies Janssen CarePath Customers of Data Breach
5.  Sony Data Breach via MOVEit Vulnerability Affects Thousands in US

Human Error: Casio ClassPad Data Breach Impacting 148 Countries

By Deeba Ahmed
All a user needs to do is visit the official WinRAR website and install the latest version to thwart the attack.
This is a post from HackRead.com Read the original post: APTs Exploiting WinRAR 0day Flaw Despite Patch Availability

According to Google’s Threat Analysis Group (TAG), the group exploiting the vulnerability comprises Sandworm, Fancy Bear, and APT40, all associated with the Russian government and military.

**_**KEY FINDINGS**_**

**Google’s TAG researchers have found that government-sponsored hackers are actively exploiting an already discovered WinRAR vulnerability.**

**This vulnerability lets hackers execute arbitrary code on the targeted device.**

**Attackers can steal sensitive data, hijack the victim’s computer, and install malware.**

**State-sponsored actors from a number of countries are exploiting this vulnerability in their malicious operations.**

**Google has urged users to immediately apply the latest WinRAR patch to prevent their devices from being invaded by state-backed actors.**

**Organizations must protect their networks by implementing a robust vulnerability management program and deploying endpoint security solutions.**

On August 25, 2023, Hackread.com reported a 0-day vulnerability in WinRAR, which was actively exploited worldwide, targeting 130 traders to successfully steal funds. It has now come to light that the vulnerability continues to be exploited, despite the availability of a security patch.

Google’s Threat Analysis Group (TAG) has discovered that state-backed threat actors are continuously exploiting a known vulnerability in the popular file archiver tool for Windows, WinRAR. The vulnerability is tracked as CVE-2023-38831, and it was exploited for the first time in early 2023 by cybercrime groups before it was identified by defenders. Now state-backed actors are exploiting it. Until August, this bug was exploited as zero-day. It was first reported by Group-IB researchers.

TAG’s Kate Morgan wrote in the report published on 18 October that despite that a patch was released soon after it was discovered, many devices remain unpatched and are vulnerable to exploitation. This is probably because the WinRAR tool doesn’t have an auto-update feature. It was fixed in WinRAR versions 6.24 and 6.23. Users have to download the patch manually.

Regarding the state-sponsored actors exploiting the WinRAR bug, TAG noted that three different clusters of attackers are involved. These include Sandworm aka FROZENBARENTS, Russian APT28 aka Fancy Bear or FROZENLAKE, and APT40 aka ISLANDDREAMS. 

For your information, Sandworm is affiliated with the Russian Armed Forces’ Main Directorate of the General Staff Unit 74455 and likes to target the energy sector. The Ukrainian drone-based email campaign Sandworm launched on September 6th exploits this bug to deliver a ZIP archive file. 

APT28 is also linked to the same unit but focuses on targeting Ukrainian government entities with a spearphishing campaign. APT40 is associated with the Chinese government and exploited this bug in late August to launch a phishing campaign targeting Papua New Guinea.

This vulnerability lets attackers execute arbitrary code on their targeted device by tricking the victim into opening a specially designed PNG file with a ZIP archive, leading to the stealing of sensitive data, installation of malware, or hijacking of the infected device. Since April 2023, cybercriminals have actively used this bug to target cryptocurrency trading accounts. 

> _“A logical vulnerability within WinRAR causing extraneous temporary file expansion when processing crafted archives, combined with a quirk in the implementation of Windows’ ShellExecute when attempting to open a file with an extension containing spaces.”_
> 
> Google’s Threat Analysis Group (TAG)

This widespread exploitation highlights that “exploits for known vulnerabilities can be highly effective, despite a patch being available” and indicates the importance of prompt application of security patches. 

****Update Your WinRAR Installer to the Latest Version****

To safeguard your system and personal data from potential threats, it’s crucial to keep your WinRAR installer up-to-date with the latest version. Updating your WinRAR software ensures that you have the latest security patches and enhancements, significantly reducing the risk of falling victim to cyberattacks.

You can get WinRaR’s latest version on its official website. Don’t wait – stay protected by regularly checking for updates and applying them as soon as they become available. Your digital security depends on it.

**_**RELATED ARTICLES**_**

1.  The Best Way to Install and Set-Up WinRAR 64-bit
2.  WinRAR vulnerability allowed attackers to remotely hijack systems
3.  Hackers are using 19-year-old WinRAR bug to install nasty malware

APTs Exploiting WinRAR 0day Flaw Despite Patch Availability

By Deeba Ahmed
Researchers report a surge in QR code-related cyberattacks exploiting phishing and malware distribution, especially QRLJacking and Quishing attacks.
This is a post from HackRead.com Read the original post: Hackers Exploit QR Codes with QRLJacking for Malware Distribution

QRLJacking tricks you with fake QR codes to log into fake websites or apps, while Quishing uses QR codes to deceive you into visiting malicious sites or downloading malware.

Quick Response Codes (aka QR Codes) have made life hassle-free for everyone as these versatile codes offer access to everything. However. according to SaaS-based cloud messaging security firm SlashNext, this versatility of QR codes makes them a potential target of exploitation. And, the company has discovered several ways in which threat actors are exploiting QR codes.

Security experts have noted a spike in QR-code-based phishing attacks, highlighting how easy it is to manipulate them. Since the codes can encode complex data and redirect users to external apps/websites, adversaries try to manipulate them. SlashNext’s research revealed two prominent methods threat actors are relying on to exploit QR codes- Quishing and QRLJacking.

Quishing attack is offered on cybercrime forums to facilitate phishing-for-hire services. In this attack, a QR code embedded with malware download or phishing link is circulated on different platforms/channels such as social media, posters, restaurant menus, ads, and phishing emails. When someone scans it, they are redirected either to a phishing website or malware gets downloaded on their devices.

Cofense discovered a similar phishing campaign in August 2023, where attackers used malicious QR codes to target high-profile organizations, including a US energy firm.

QRLJacking (quick response code login jacking) is a social engineering-based method exploiting the login with QR code feature in apps and websites and mostly exploits frequently expiring QR codes. If successful, the attack can lead to a complete account takeover.

In QRLJacking, the adversary creates a phishing site identical to the login page of their targeted website/app and creates a fake QR code. The phishing link is sent to the victim through messaging apps, email, or SMS.

When the code is scanned, they get logged into the bogus session and not the real app, and their sensitive data such as access tokens are stolen. An incident of QRLJacking was reported in August 2023 by cybersecurity researcher Cristian ‘void’ Giustini targeting the Steam gaming platform.

“Phishing Email with Malicious QR Code Targeting Microsoft Users and Steam’s QR-Enabled Phishing Page”

In a blog post, Daniel Kelley of SlashNext wrote that attackers can employ a wide range of techniques to exploit QR codes, such as:

*   **Phishing:** Through phishing attacks, threat actors can exploit QR codes to redirect users to bogus websites mimicking legitimate ones, and lure them into entering sensitive data like financial information or login credentials.
*   **Malware Distribution:** Cybercriminals can embed QR codes with links that deploy malware on the user’s devices and allow them to gain unauthorized access.
*   **Social Engineering:** QR codes can be manipulated to display misleading information/promotion offers to trick users into taking actions that offer monetary benefits to the attacker.

Being cautious is essential to protect yourself against QR code-based attacks. Always scan QR codes from trusted sources and cross-check the destination URL before scanning. Regularly update anti-virus software. Organizations should implement secure QR code generation and management systems and conduct security audits of QR code usage regularly.

****_RELATED ARTICLES_****

1.  Barcode Reader Apps on Play Store Infected with Adware
2.  Stream-Jacking: Malicious YouTube Livestreams Aid Malware
3.  How to make a QR code to accept Bitcoin while keeping it secure
4.  “Picture in Picture” Technique Exploited in Deceptive Phishing Attack
5.  Fake ROBLOX and Nintendo game cracks drop ChromeLoader malware

Hackers Exploit QR Codes with QRLJacking for Malware Distribution

By Waqas
Cybercriminals are using phishing emails and text messages to steal sensitive data from plastic surgery clinics and offices, such as patient records and financial information.
This is a post from HackRead.com Read the original post: FBI Warns of Extortionists Stealing Plastic Surgery Data for Ransom

The FBI also warns that cybercriminals are using this stolen data to extort victims, threatening to release it to the public or to the victims’ employers or families.

Cybercriminals are using phishing emails and text messages to gain access to plastic surgery offices’ networks and steal sensitive data, such as **patient records, photos** and financial information, the FBI warns.

Once they have this data, they threaten to release it to the public or to the victims’ employers or families unless they receive a **ransom payment in cryptocurrency**.

The FBI **says** that cybercriminals are using a three-phase approach to carry out this scam:

****1: Data Harvesting****

Cybercriminals use phishing emails and text messages to trick plastic surgery offices into clicking on malicious links or opening attachments. Once a victim clicks on a malicious link or opens an attachment, malware is installed on their computer. This malware allows cybercriminals to steal sensitive data, such as patient records and financial information.

****2: Data Enhancement****

Cybercriminals use open-source information, such as social media profiles, to “enhance” the stolen data. This means that they gather additional information about the victims, such as their employment history, photos, family members, and friends. Cybercriminals then use this enhanced data to make their extortion threats more credible.

****3: Extortion****

Cybercriminals contact plastic surgeons and their patients via social media, email, text messages, or messaging apps to demand ransom payments. They threaten to release the victims’ sensitive data to the public or to their employers or families unless they pay a ransom in cryptocurrency.

Claude Mandy, Chief Evangelist, Data Security at **Symmetry Systems**, a San Francisco, Calif.-based leader in data security posture management argued the data security practises and capabilities of plastic surgery clinics stating that most regular doctor’s offices face the challenge of needing to share this information to safeguard lives, but lack the security capabilities to ensure data protection and monitor for unauthorized access or suspicious activity.

_“_Cybercriminals are focused on monetizing access to data through either impacts to the availability of lifesaving data, or increasingly the threat of releasing sensitive and sometimes embarrassing data to the public,_“_ said Claude. _“_Nation states may use similar tactics to coerce users to perform activities in their interests. Medical records, especially some forms of plastic surgery, have become obvious targets as a result._“_

****FBI’s Recommendations****

The FBI recommends that plastic surgery offices and patients take the following steps to protect themselves from this scam:

*   Be suspicious of unsolicited emails and text messages, especially those that ask for personal information or financial data.
*   Do not click on links in emails or text messages from unknown senders.
*   Use strong passwords and enable multi-factor authentication on all accounts.
*   Keep software up to date on all devices.
*   Back up data regularly.

****Here are some additional tips to protect yourself from this scam:****

*   Be careful about what information you share online, especially on social media.
*   Be careful about who you give your contact information to.
*   Be aware of the signs of phishing emails and text messages.
*   If you receive an email or text message that seems suspicious, do not click on any links or open any attachments.
*   If you are unsure about whether an email or text message is legitimate, contact the sender directly.

If you are a plastic surgery office or patient and you believe you may have been the victim of this scam, you should report it to the FBI’s Internet Crime Complaint Center (IC3) at www.ic3.gov.

****_RELATED ARTICLES_****

1.  FBI and NCSC Warn of Foreign Cyberattacks on US Space Sector
2.  FBI and CISA Issue Joint Advisory on Snatch Ransomware Threat

FBI Warns of Extortionists Stealing Plastic Surgery Data for Ransom

By Waqas
Prepare to pay for Twitter (X).
This is a post from HackRead.com Read the original post: Elon Musk’s X (Twitter) to Charge $1 for Basic Features

To start, X will charge $1.43 NZD from new users in New Zealand and ₱42.51 PHP per year from new users in the Philippines.

Elon Musk’s X (formerly Twitter), has announced that the platform will start charging new users $1 per year for basic account features as part of his “Not-A-Bot” initiative.

The fee will initially apply to new users in New Zealand and the Philippines, and X plans to expand it to all new users globally. The fee will apply to basic features such as tweeting, replying to tweets, liking and bookmarking tweets, and creating lists. Existing users will not be affected by the fee.

> _“New users will be able to perform certain actions on the web version of the platform: post content, Like posts, Reply, Repost and Quote other accounts’ posts, and Bookmark posts.”_
> 
> _“New users who opt out of subscribing will only be able to take “read only” actions, such as: Read posts, Watch videos, and Follow accounts.”_
> 
> **X**

The company said the fee is necessary to reduce the number of bots and spammers on the platform. He has also said that he wants to make X more sustainable and that charging users a small fee will help to cover the costs of running the platform.

There has been some mixed reaction to the news. Some users have expressed support for the fee, saying that it is a small price to pay to keep the platform free of bots and spammers. Others have expressed concern that the fee will make X less accessible to users in developing countries.

It remains to be seen how the fee will impact X’s user base and overall growth. However, Musk is serious about making X more profitable.

> Starting today, we’re testing a new program (Not A Bot) in New Zealand and the Philippines. New, unverified accounts will be required to sign up for a $1 annual subscription to be able to post & interact with other posts. Within this test, existing users are not affected.
> 
> This…
> 
> — Support (@Support) October 17, 2023

****Why New Zealand and the Philippines?****

In 2022, 47.4% of all internet traffic came from bots, while at 52.6%, human traffic decreased to its lowest level in eight years. According to the 2023 State Of The Web from Gloucester, United Kingdom-based domain and hosting experts Fasthosts, “._bot_ is predicted to be a TLD (top-level domain) to watch out for as registrations to the word bot are set to see a huge increase.”

The press release from Fasthosts titled “X’s War on Bots” shared with Hackread.com, implies that Elon Musk’s decision to charge users is a component of his “Not-A-Bot” initiative. This initiative has revealed that the majority of bot accounts on the social media platform are registered in specific locations, namely New Zealand and the Philippines.

**Analysis**

Musk’s decision to charge users for basic features is a controversial one. It is unclear how the fee will impact X’s user base and overall growth. Yet, the fee could help to reduce the number of bots and spammers on the platform. It could also generate additional revenue for X, which could be used to invest in new features and improve the platform’s overall user experience.

However, the fee could also make X less accessible to users in some countries. It could also discourage some users from signing up for an account or using the platform regularly. Overall, it remains to be seen how Musk’s decision to charge users for basic features will impact X in the long term.

1.  Elon Musk deletes Tesla & Space X Facebook pages
2.  YouTube Takes on Ad Blockers with Warning Pop-Ups
3.  Why torrenting on Elon Musk’s Starlink is not a good idea?

Elon Musk’s X (Twitter) to Charge $1 for Basic Features

By Deeba Ahmed
Qubitstrike Malware Uses Discord for C2 Communications in Cryptojacking Campaign Targeting Jupyter Notebooks.
This is a post from HackRead.com Read the original post: Qubitstrike Malware Hits Jupyter Notebooks for Cryptojacking and Cloud Data

****_KEY FINDINGS_****

**Cryptojackers are targeting Jupyter Notebooks to deploy Qubitstrike malware, reports Cado Security.**

**Exposed Jupyter Notebooks are exploited in this campaign, mainly those deployed in cloud environments.**

**The objective is to steal cloud service providers’ credentials and access cloud services.**

**Qubitstrike is an evolving malware campaign looking for vulnerabilities in Jupyter Notebooks configurations and supporting SSH propagation.**

**Attacks can install additional malware, steal sensitive data, and interrupt research activities.**

Jupyter Notebooks are widely used tools by data scientists and researchers. According to new research from Cado Security Labs, threat actors are targeting vulnerable Jupyter Notebooks configurations to obtain unauthorized access to target systems and deploy Qubitstrike malware.

The primary objective of this campaign is to steal cloud services provider (CSP) credentials and install cryptominers. This indicates threat actors are trying to disrupt scientific research. Cado researchers noted that attackers use stolen CSP credentials to expand their scope of exploitation.

It is a multi-stage attack in which malware developers infiltrate the targeted system by sending phishing emails to unsuspecting users or using social engineering tactics. After successful infiltration, the malware establishes a connection with a remote C2 server to control the compromised system remotely. Once this is done, the attackers exploit the notebooks’ ability to execute arbitrary code for executing a malicious mi.sh shell script, disguised as a legitimate data analysis tool.

This script retrieves/executes an XMRig miner and ensures it is executed every time the system is rebooted. It also terminates any existing mining operations in the system, adds the adversary’s SSH key to the system to create a persistent backdoor, and installs a rootkit to hide malicious processes.

Now, attackers can perform a wide range of nefarious activities, including installing additional malware/backdoors on the system, stealing intellectual property or sensitive data such as cloud service provider credentials, and interrupting/sabotaging research. Attackers can deliver the shell script to related hosts through SSH as well. The data is exfiltrated via Telegram Bot API.  

Qubitstrike campaign payloads are hosted on the Git hosting platform’s alternative service, codeberg.org, and Discord is used for command and control communications. Cado Security researchers claim that this is the first time they discovered this platform being used in an active malware campaign.                                            

It’s possible that Codeberg’s up-and-coming status makes it attractive as a hosting service for malware developers,” Cado Security’s report read.

Qubitstrike output displayed in Discord (Cado Security)

Qubitstrike malware’s advanced C2 infrastructure using Discord’s bot functionality for issuing commands on compromised nodes or tracking the campaign’s progress highlights the need to focus on this emerging threat targeting scientific computing environments and employ robust cybersecurity measures in these domains.

For your information, Jupyter Notebooks are web-based interactive computing platforms designed for remote or on-premise servers but generally, these are used in cloud environments. It hosts individual code snippets and lets users execute the code in an isolated environment. Google and Amazon Web Services (AWS) offer Jupyter Notebooks as managed services.

**_**RELATED ARTICLES**_**

1.  SSH Remains Most Targeted Service in Cado’s Cloud Threat Report
2.  Supply Chain Attack Targeting Telegram, AWS and Alibaba Cloud Users
3.  Cloud Service Provider Cloudzy Accused of Aiding Ransomware and APTs

Source

HackRead