By Owais Sultan
Let's code, kids!
This is a post from HackRead.com Read the original post: How to Teach Your Child Coding: A Gift for Their Digital Future

As we progress through the digital age, coding is rapidly gaining traction as a logic-based skill that can fuel creativity in both kids and teens. Another beauty of technology is that children have access to an array of resources, such as coding apps, websites, online courses, games, and more.

However, teaching coding to kids and teens using traditional methods can be quite challenging. Parents and educators are increasingly opting for age-appropriate, engaging, and enjoyable ways to teach coding.

This approach helps young learners develop the skills required in the programming world. Keep reading this post to discover five exciting ideas to make coding fun for kids and teens.

**Innovative Approaches to Teach Coding to Kids**

Many programming concepts will be entirely new to young learners. As such, it’s essential to introduce each concept incrementally. Recent research indicates that students across all age groups retain information more effectively when they learn in a fun and engaging manner. This insight opens the door to discovering new methods for teaching coding to children.

If the learning process becomes dull, it can quickly dampen the student’s interest, regardless of the subject matter. Before teaching coding, convey to your child the excitement and enjoyment they may find in programming.

The prospect of building websites, games, animations, apps, and more will pique their curiosity about coding. Here are some tips to make learning coding a fun and immersive experience for kids and teens:

**1\. Leverage Toys for Skill Development**

One of the most effective ways to enhance kids’ creativity is by introducing them to toys like Legos, Mechanix, and others. Depending on the child’s age, you can engage them in the design and creation process of these toys. This approach will bolster their logical, observational, creative, and reasoning abilities, paving the way for learning the basics of programming.

**2\. Explore Coding through Minecraft**

Getting kids and teens involved in Minecraft serves as an excellent motivator for learning to code. Widely accessible on gaming consoles and desktops, Minecraft introduces young learners to various coding elements in an enjoyable manner. The game employs a straightforward structure to craft objects, making it an engaging learning tool.

**3\. Utilize Websites and Apps for Coding Instruction  
**

Presently, numerous websites and applications offer block-based coding lessons to kids and teenagers. Popular platforms like Thunkable and code.org provide tailored learning experiences, allowing you to select the most suitable resource for your needs.

These websites are specifically designed to teach children by integrating visual code blocks into entertaining projects. The combination of vibrant graphics and block code helps make the coding process more approachable and less daunting.

**4\. Utilize Engaging Media Resources**

There are numerous resources available today for teaching children coding, such as YouTube, TikTok, and online communities. Streaming programming videos on YouTube prompts the algorithm to suggest related coding videos for both you and your child. YouTube offers a wealth of information tailored to various learning styles for coding.

Choose the right YouTube video to help kids and teenagers grasp binary code. Videos, especially animated ones, can simplify complex coding concepts and make them enjoyable. For offline education, parents can turn to books or magazines featuring engaging imagery that sparks interest and motivates children and teens to delve into coding studies.

**5\. Embrace Learning from Children**

Recent research suggests that learning by teaching is an effective strategy for deepening one’s understanding of a concept. If your child is learning to code, encourage them to share their knowledge with someone else. You can participate by providing an opportunity for them to teach you a new coding concept. Asking questions about these concepts helps reinforce their learning and motivates them to continue learning.

**The Benefits of Learning to Code for Kids and Teenagers**

Coding involves giving instructions to a computer to perform specific tasks. By learning coding through resources like the CodeMonkey course, your children can secure a brighter future. They’ll develop logic and computational thinking skills to tackle various challenges in life. Additionally, coding fosters persistence, collaboration, and communication skills. Let’s explore how kids can benefit from learning to code:

**1\. Developing Crucial Skills**

One of the major advantages of learning to code is the enhancement of problem-solving, creativity, and logical thinking abilities. Children are provided with numerous opportunities to practice and refine these skills, which are essential for both personal growth and professional success.

**2\. Building Confidence**

As kids and teenagers learn to articulate their ideas and grasp fundamental concepts, their confidence increases. This newfound confidence enables them to develop websites and applications more effectively.

**3\. Discovering New Concepts**

Coding offers a hands-on learning approach that encourages kids and teenagers to explore and interact with their environment. This method helps them learn from their mistakes and experiment with various solutions to find the most appropriate one.

**4\. Enhancing Communication Skills**

Coding requires breaking down complex ideas into simpler forms and effectively communicating them to computers. For a computer to execute a specific task, the message must be clear and precise.

As a result, not only do children’s computer communication skills improve, but their verbal and written abilities also see growth. Strong communication skills are essential for success in life.

**Closing Thoughts**

This article aims to guide you in discovering engaging methods for teaching your child coding. By making learning enjoyable, children are more likely to retain concepts for longer periods and apply them effectively.

In today’s world, coding is a crucial aspect of childhood education. Learning to code prepares kids and teenagers for success in future careers while enhancing problem-solving capabilities and creativity.

Through coding skills, individuals can create computer software, apps, websites, games, and more. It’s vital to introduce these future skills to your child to help them stand out in a competitive environment.

Moonpreneur recognizes the demands and needs that our rapidly evolving technological landscape presents for our children. As a result, we’re on a mission to educate and inspire entrepreneurship through our comprehensive online STEM programs, which help kids master futuristic sciences such as robotics, game development, app development, advanced math, and more! Sign up for a free 60-minute robotics and coding class today!

1.  5 Ways to Ensure Your Child’s Online Safety
2.  10 Android Ed Apps That Collect Most User Data
3.  Top 6 Cell Phone Tracker Apps for Parental Control
4.  Kids breach and bypass Linux Mint screensaver lock
5.  Teen Hackers on Discord Sell Malware for Quick Cash

How to Teach Your Child Coding: A Gift for Their Digital Future

By Deeba Ahmed
The Chromium-based browsers include Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and several others.
This is a post from HackRead.com Read the original post: Rilide Malware – New Crypto Stealer Hits Chromium-Based Browsers

Riligy malware is disguised as a legitimate Google Drive extension and allows attackers to capture screenshots, monitor users’ browsing history, and inject malicious scripts to steal funds from cryptocurrency wallets.

The cybersecurity researchers at Trustwave SpiderLabs have disclosed alarming details on a new strain of Rilide malware that targets Chromium-based browsers to steal cryptocurrency funds and monitor users browsing activities.

In the newly discovered campaign, SpiderLabs researchers noticed that threat actors have created legitimate-looking Google Drive extension that hides Rilide malware.

SpiderLabs researchers believe Rilide malware is unique because of its capability of generating dialogues to trick users into giving away their 2FA keys. This is a rare feature that helps the attacker withdraw cryptocurrencies discreetly.

In addition to this, the malware also allows attackers to carry out an extensive range of activities, including capturing screenshots, monitoring users’ browsing history, and injecting malicious scripts to steal funds from cryptocurrency wallets.

The researchers have confirmed that Rilide malware targets Chromium-based browsers, including Microsoft Edge, Google Chrome, and Opera to achieve its malicious objectives.

The fact that Google Drive is being used maliciously is not surprising. A study conducted last year found that 50% of all malicious Office document downloads were from Google Drive. Another study revealed that Apple Safari was the safest browser while Google Chrome was the riskiest browser in 2022.

As for Rilide malware, during their investigation, SpiderLabs researchers detected multiple such extensions for sale in March 2022. They also noted that a portion of Rilie malware source code was recently leaked by someone on an underground hacking forum over payment issues.

This leaked code can swap cryptocurrency wallet addresses from the clipboard with the attacker’s address. Moreover, the C2 address embedded in the Rilide code can identify GitHub repositories belonging to a user named gulantin, which contains the extension’s loader.

**Attack Chain**

Researchers have detected two attack methods to install the malicious extension, Ekipa RAT and Aurora Stealer. Ekipa RAT is distributed through booby-trapped Microsoft Publisher documents, whereas fake Google Ads serve as Aurora Stealer’s distributor.

Their attack chains encourage the execution of a Rust-based loader, which can modify the browsers’ LNK shortcut file and launch the add-on using the “–load-extension” command line switch.

_Infection Chains_ (Trustwave)

Ekipa RAT can carry out targeted attacks. Conversely, Aurora, first spotted in April 2022 on Russian-speaking underground forums, is a Go-based stealer offered as a Malware-as-a-Service (Maas) tool. It can take data from different web browsers, local systems, and cryptocurrency wallets.

“The Rilide stealer is a prime example of the increasing sophistication of malicious browser extensions and the dangers they pose,” the report read.

1.  Malicious Firefox extension phish Gmail credentials
2.  Ad-blocker Chrome extension injected ads in Google
3.  Fake ChatGPT Extension Hijacks Facebook Accounts
4.  Phishing attack uses Google Drive against researchers
5.  Chrome extensions harboring Dormant Colors malware

Rilide Malware – New Crypto Stealer Hits Chromium-Based Browsers

By Deeba Ahmed
The findings are to be presented at the Usenix Security Symposium.
This is a post from HackRead.com Read the original post: WiFi Flaws Allow Network Traffic Interception on Linux, iOS, and Android

The WiFi flaw discovered by researchers from Northeastern University and KU Leuven can impact a wide range of operating systems, including Linux, iOS, and Android, leaving them vulnerable to potential interception of network traffic if exploited by hackers.

Wireless networking stacks found in a wide range of operating systems were left vulnerable due to an ambiguity in the WiFi specification, explained academics from Northeastern University and KU Leuven in a paper (PDF) titled “Framing Frames: Bypassing WiFi Encryption by Manipulating Transmit Queues.” The ambiguity can allow exposure of network traffic if exploited by threat actors.

**Research Findings**

According to researchers Domien Schepers, Aanjhan Ranganathan, and Mathy Vanhoef, the issue is caused by a fundamental design flaw detected in the IEE 802.11 WiFi protocol standard. The devices impacted by this issue include those running FreeBSD, Linux, iOS, and Android. Aruba, Asus, and D-Link devices were also examined for this research.

If exploited successfully, it can allow attackers to hijack TCP connections. Additionally, they can intercept client and web traffic. Vanhoef shared these findings at the 2023 Real World Crypto (cryptography) Symposium in Tokyo, Japan. The paper is to be presented at the Usenix Security Symposium.

**Security Advice**

*   Securing your Spectrum-compatible WiFi routers
*   How To Keep Your Router, WiFi Safe From Hackers
*   Wireless Router Security: Set up a WiFi router securely

**What’s The Issue?**

Vanhoef explained the findings in a video presentation, sharing that an attack called kr00k revealed by ESET in 2019 shares similarities with the attack his team had developed as both involve similar vulnerabilities, indicating that the IEEE 802.11 WiFi standard cannot articulately handle buffered framed. 

WiFi frames contain different types of data related to network routing and traffic and include a header, body, and trailer, which allow data to move from one point to another. WiFi access points queue frames linked with different network layers and buffers them until the right network sources are available to send them. In this case, researchers noted that the WiFi specification didn’t describe how to manage the security context in buffered frames.

**How Can The Flaw Be Abused?**

Researchers wrote that attackers would exploit power-save mechanisms in endpoint devices to trick access points into exposing data frames in plaintext. Or else an all-zero key would allow them to encrypt it. Due to the power-save bit’s “unprotected nature” in a frame’s header, the issue allows an attacker to enforce queue frames for a particular client.

This would result in disconnecting and executing a DoS (denial of service) attack. The objective is to leak the frame from the access point linked to the victim’s client station. It works because, during the security context changes, most WiFi stacks didn’t appropriately dequeue/purge their transmit queues.  

The attacker can send a spoofed power-save frame with an Association or Authentication frame and successfully reset the wireless connection by making the access point respond by removing the client’s pairwise key. If the adversary uses a Wake-Up frame, the access point will send the buffered data under an undefined security context and prompt a data frame leak.

Furthermore, in a security context override attack, the access points can encrypt unqueued frames through the attacker’s chosen key, thus, rendering the encryption ineffective. Researchers have published a proof-of-concept exploit titled MacStealer. This tool tests networks to identify vulnerability to a client isolation bypass.

1.  WiFi software firm leaked millions of users’ data
2.  iPhone Wifi bug exposed devices to remote attacks
3.  Avoid being Pwned by bugs residing in the WiFi chip
4.  Flaws exposed all WiFi enabled devices to FragAttacks

WiFi Flaws Allow Network Traffic Interception on Linux, iOS, and Android

By Deeba Ahmed
Researchers warned that the campaign works through a network of fake websites that promote seemingly harmless crypto apps and other software.
This is a post from HackRead.com Read the original post: New VPN Malvertising Attack Drops OpcJacker Crypto Stealer

The primary target of the OpcJacker Crypto malware campaign are unsuspecting users in Iran who were tricked into downloading an archive file that contained the novel Opcjacker malware. 

Trend Micro cybersecurity researchers discovered a new malvertising campaign in February 2023 targeting Iranian users and distributing Opcjacker malware. They dubbed the malware Opcjacker due to its opcode configuration design and cryptocurrency-stealing capabilities.

The use of VPNs in malvertising attacks against Iranian users should not be surprising. In October 2022, Iranian hackers were spreading “**RatMilad**” Android spyware disguised as a VPN app.

**More Context**

1.  Iranian group hacking VPNs for “Fox Kitten Campaign”
2.  Phones of Iran’s protest detainees targeted with spyware
3.  VPN malvertising hits Persian speakers Baháʼí faith followers

**VPN Malvertising Attack Drops Opcjacker **

The campaign works through a network of fake websites that promote harmless-looking crypto apps and other software. In the newly analyzed sample, malvertisements were hidden inside a genuine VPN app. Users in Iran were tricked into downloading an archive file that contained the novel Opcjacker malware. 

The fake website distributing the OpcJacker crypto stealer (Credit: Trend Micro)

**How Does the Attack Work?**

Malware loads automatically by patching a legit DLL library in an installed program, which loads the next malicious DLL library. This library eventually runs the shellcode that contains the loader and runner of another malicious app. This app is different from Opcjacker as it has been assembled from data chunks stored in files of WAV, CHM, and other formats. 

**Analyzing Opcjacker**

Researchers noted that Opcjacker is a novel and interesting malware. Its configuration file has a custom file format resembling custom virtual machine code that outlines the stealer’s behaviour.

In the configuration file, researchers found numeric hexadecimal identifiers that force the malware to perform certain functions and make it difficult for researchers to identify the malware’s code flow.

“The configuration file format resembles a bytecode written in a custom machine language, where each instruction is parsed, individual opcodes are obtained, and then the specific handler is executed,” researchers wrote in the **report**.

**Opcjacker’s Capabilities and Functionalities**

In this campaign, scammers have concealed Opcjacker through a crypter called **Babadeda**. It uses the configuration file for activating the malware’s data-stealing capabilities, running arbitrary shellcode, and other executables.

The malware’s functions include capturing screenshots, keylogging, loading new modules, stealing private/sensitive user data from browsers, and hijacking cryptocurrency wallets by **replacing addresses in the clipboard**.

In addition, Opcjacker can deliver next-stage payloads like **NetSupport RAT** along with an hVNC (hidden virtual network computing) variant to allow the attacker remote access.

The infection chain

Researchers believe the campaign is financially motivated because Opcjacker can steal cryptocurrency. The malware is being distributed in the wild since at least mid-2022 in different malvertising campaigns but it is still evolving and under active development.

1.  New malvertising attack is spreading backdoor
2.  Fake Tor Browser Installers Drop Clipper Malware
3.  CISA says use ad blockers to fend off ‘malvertising’
4.  Malvertising attack affected millions of PornHub users

New VPN Malvertising Attack Drops OpcJacker Crypto Stealer

By Waqas
The cyberattack has forced the technology giant to shut down and take some of its operations offline.
This is a post from HackRead.com Read the original post: Western Digital Security Breach – Hackers infiltrate Internal Systems

The Western Digital security breach appears to have been linked to ransomware, but so far, no major ransomware group has claimed responsibility for the attack.

On March 26, 2023, data storage company Western Digital suffered a “network security incident” where hackers managed to access several of its internal systems, confirmed the California-based firm.

The breach appears to have been linked to ransomware, although Western Digital has not revealed how it was compromised. The company is currently working to determine the nature and extent of the data that was stolen by the hackers.

So far, the perpetrators remain unknown and no major ransomware group has claimed responsibility for the attack.

It’s not surprising that Western Digital has experienced another security breach, given that in 2021, hackers were able to remotely wipe the hard drives of Western Digital My Book Live.

In a statement, Western Digital said that “Based on the investigation to date, the company believes the unauthorized party obtained certain data from its systems and is working to understand the nature and scope of that data.”

Western Digital stated that the incident caused disruption to its business operations and downed its My Cloud network-attached storage service, which enables users to access their files over the internet.

According to the company, it is taking proactive measures to secure its business operations, which include taking some systems and services offline. The company is also taking additional steps as necessary to prevent further security breaches.

The company assured customers that it is implementing security measures to prevent future cyber attacks and is also working to restore the affected infrastructure and services.

Western Digital is working with a cybersecurity firm whose name has not been revealed, and coordinating with law enforcement to investigate the breach.

The data breach at Western Digital highlights the continuing threat of cyber attacks to companies and their customers. It is a timely reminder for organizations to take proactive measures to secure their networks and protect sensitive data.

1.  Don’t Sell Your Laptop Without Following These Steps
2.  UCLA researcher destroyed hard drive amid FBI probe
3.  Sonic & Ultra signals crash Windows, Linux & hard drives
4.  Hard drives with data of 29K Facebook employees stolen
5.  Ex-employee stole hard drive with Coca-Cola workers’ data

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Western Digital Security Breach – Hackers infiltrate Internal Systems

By Waqas
Mullvad VPN and the Tor Project Join Forces to Launch Mullvad Browser, a Privacy-Focused Web Browser.
This is a post from HackRead.com Read the original post: Mullvad VPN and Tor Project Release Mullvad Browser

Good news for those seeking online privacy and anonymity as Mullvad Browser is now available for free download.

Mullvad VPN and the **Tor Project** have partnered to launch the Mullvad Browser, a new privacy-focused web browser. The browser has been developed to offer users a secure browsing experience and to minimize tracking and fingerprinting.

Mullvad browser is designed to be used with Mullvad VPN, a trustworthy VPN, to provide even greater privacy and security.

The Tor Project, the team behind the popular **Tor browser**, is a nonprofit organization that aims to defend online privacy and advance human rights by creating and deploying free, open-source anonymity and privacy technologies.

In a **press release**, Jan Jonsson, CEO of Mullvad VPN said, “The Tor Project is the best in the field of privacy-focused browsers. That’s why we reached out to them. We also share their values of human rights and online privacy. The Mullvad Browser is all about providing more privacy alternatives to reach as many people as possible and make life harder for those who collect data from you.”

For your information, Mullvad VPN was founded in 2009 and is widely considered to be one of the most secure and privacy-focused VPN services available today.

The company is based in Sweden and offers a secure, private, and anonymous VPN service that allows users to browse the internet without being tracked or monitored.

Mullvad VPN uses advanced encryption technology to protect user data and offers a no-logging policy to ensure that user activities are not tracked or recorded. Now, the service is also designed to work seamlessly with the Tor network, providing an additional layer of privacy and security for users.

The Mullvad browser is available for free and **can be downloaded** on Windows, MacOS, and Linux platforms.

“We want to free the internet from mass surveillance and a VPN alone is not enough to achieve privacy. From our perspective, there has been a gap in the market for those who want to run a privacy-focused browser as good as the Tor Project’s but with a VPN instead of the Tor Network,” Jonsson said.

For your information, another option that offers VPN along with Tor browser integration is **Brave browser**.

1.  Tor and Its 10 Best Alternatives
2.  Mozilla VPN – Firefox private network VPN
3.  Download the official Tor browser on Android
4.  ProtonVPN launches Chrome and Firefox extensions

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Mullvad VPN and Tor Project Release Mullvad Browser

By Waqas
Ukrainian hacktivists extracted personal information, including sensitive military data and even nude photos of one of the targeted military wives.
This is a post from HackRead.com Read the original post: Ukrainian Hacktivists Trick Russian Military Wives for Personal Info

The hacktivists convinced the wife of a serving colonel in the Russian military to participate in a patriotic photoshoot. She then convinced 12 more military wives to join, which allowed the hacktivists to extract personal and sensitive information.

Ukrainian hacktivists group Cyber Resistance aka the Ukrainian Cyber Alliance reportedly came up with a unique strategy to hack into their targeted Russian military personnel’s email accounts.

The hacktivists extracted information on Colonel Sergey Valeriyevich Artoshchenko by tricking his wife into doing a patriotic photoshoot. For your information, Artoshchenko is commissioned at an aviation unit (960th Assault Aviation Regiment) in Crimea.

In 2018, Russian hackers were reportedly accused of posing as ISIS and sending death threats to US army wives. When it comes to posing as someone else, this incident bears some similarities to the recent hack by Ukrainian hacktivists.

**Cyber Resistance and InforNapalm**

InfoNapalm was created in 2014, and Cyber Resistance in 2016 in response to the Russian annexation of Crimea. These groups have been spreading information about the disputes between Russia and Ukraine over the years. After the Russian invasion of Ukraine in February 2022, their efforts to sabotage the Russian military have doubled.

**How Cyber Resistance Exploited Russian Military Wives?**

Cyber Resistance hacktivists targeted the colonel for his reported involvement in the bombing of a civilian-packed theatre in Mariupol in March 2022.

The hacktivists convinced his wife for a photoshoot wearing her husband’s uniform jacket under the pretext that the photos will be featured on a pinup calendar to increase the Russian military’s morale.

Mrs. Artoshchenko was contacted by one of the hackers posing as an officer from her husband’s regiment. She contacted 12 other military wives to participate in this photoshoot.

The unsuspecting army wives took photos wearing the uniforms of their husbands. The photos provided Ukrainian hackers with enough information to track down the personal details of their husbands, mainly Col. Artoshchenko. The other officers were also involved in the attack. 

Cyber Resistance hacktivists collaborated with a Pro-Ukrainian open-source intelligence group, InfoNapalm, to publish the data on its Telegram channel.

**How Do Hackers Locate Officers?**

The hacktivists obtained sufficient professional data from the target’s uniform and used his COVID-19 vaccination records to locate his current home, duty station, and other details. They hacked into the Russian Ministry of Defence website portal to hack email and get details on his salary.

In addition, they got almost all key personal details, such as the colonel’s date of birth, address, and phone numbers. The data is available on the InfoNapalm website. Hackers even managed to locate and publish his photo and images of his official documents and residence.

Moreover, they didn’t spare his wife as they hacked and shared her private data, including her phone number, passport number, birth date, and email ID to the InfoNapalm website. Hackers also found near-nude and nude photos of Mrs. Artoshchenko, two of which were published by InfoNapalm.

“Among the large volumes of correspondence and spam in the mail dumps of the 960th AAR commander, Col. Sergey Atroshchenko, we managed to find and isolate various detailed lists of pilots, performance evaluation records of officers, bulletins, memos, theoretical and practical calculations, etc. which are of material interest for the Ukrainian intelligence,” InfoNapalm revealed in its report.

The news outlet said it would not post the full data dump for public viewing because they want Russians to keep speculating about the scope of the leak. The platform thanked their “hacktivists friends from Cyber Resistance” for providing an opportunity to post this “exciting story” for the public.

1.  Hackers used seductive female images to hack IDF phones
2.  Hackers posed as women to install malware on IDF’s devices
3.  Hackers use fake female Facebook profiles for Android spyware
4.  Hackers use female avatars to steal data from Syrian opposition
5.  Hackers breach Israeli military servers using IDF women’s photos

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Ukrainian Hacktivists Trick Russian Military Wives for Personal Info

By Deeba Ahmed
Researchers have noted that attackers are targeting a medium-severity Zimbra vulnerability that the company patched in version 9.0.0 Patch 24, one year ago.
This is a post from HackRead.com Read the original post: Zimbra email platform vulnerability exploited to steal European govt emails

The cybersecurity researchers at Proofpoint have disclosed a new phishing campaign from the Russian APT group known as Winter Vivern, TA473, and UAC-0114. The group has been exploiting a vulnerability in Zimbra Collaboration software to hack the emails of government agencies in different European countries.

Although it is yet unproven which nation-state supports this APT group, security researchers believe that its activities are in alliance with the interests of Belarus and Russia.

For your information, Zimbra Collaboration is a business collaboration and email platform that allows users to send and receive emails, and manage contacts, calendars, and tasks. It can be used on-premise or in the cloud and is used by governments, educational institutions, service providers, and businesses.

**How Does the Group Target Victims?**

Winter Vivern’s modus operandi entails sending out phishing emails impersonating the target organizations or their parent organizations’ employees with political affiliation to the government.

These emails are sent from email IDs having compromised domains or hosted on vulnerable WordPress websites. The email message includes a link to a resource of the target organization’s official website.

The phishing email (Credit: Proofpoint)

However, this is a spoofed link as it redirects the recipient to a payload hosted on the attacker’s domain or a credential-stealing web page. This technique’s efficacy is now enhanced with a cross-site scripting vulnerability found in Zimbra.

**APT Group Exploiting Zimbra Vulnerability**

Zimbra is an open-source, on-premise and Cloud enabled business collaboration and email platform used by “hundreds of millions of mailboxes across 140 countries,” as per its website. The service is used by governments, educational institutions, service providers, and small to medium-sized businesses.

Proofpoint researchers noted that Winter Vivern is targeting the medium severity Zimbra vulnerability tracked as CVE-2022-27926, which Zimbra already patched in version 9.0.0 Patch 24, one year ago. The XSS flaws can allow threat actors to create links with appended code, which execute malware inside the browser when opened.

**Modus Operandi and Possible Dangers**

In the current campaign, the hackers target government agencies through vulnerable Zimbra installations/web interfaces and send phishing emails with links that exploit the XSS flaw and execute encoded JavaScript. When it is executed by the browser, a larger JavaScript payload is fetched from the attackers’ server and executed on the website in what’s called a cross-site request forgery attack. 

Attackers can now steal the victims’ usernames, passwords, and active CSRF tokens obtained from a cookie and transfer the information to their server. After obtaining login credentials and tokens, the malicious JavaScript uses hardcoded URLs to hijack the email portal.

“In some instances, researchers observed TA473 specifically targeting RoundCube webmail request tokens as well. This detailed focus on which webmail portal is being run by targeted European government entities indicates the level of reconnaissance that TA473 conducts before delivering phishing emails to organizations,” Proofpoint’s report read.

“These labour-intensive customized payloads allow actors to steal usernames, passwords, and store active session and CSRF tokens from cookies facilitating the login to publicly facing webmail portals belonging to NATO-aligned organizations,” Proofpoint noted.

**Who Are Vulnerable?**

Organizations that haven’t patched their Zimbra products in the past year are vulnerable to TA473 attacks. To prevent such attacks, it is important to restrict resources on publicly available webmail portals. This would prevent APT groups from engineering customized scripts that can steal credentials and log into the victim’s webmail accounts.

**Winter Vivern’s Past Victims**

The group’s past victims were located in India, Vietnam, Lithuania, Slovakia, and the Vatican. Sentinel Labs reported earlier in March that the group’s recent targets include Italian and Ukrainian Foreign Affairs ministries, Polish government agencies, Indian government officials, and telecommunication firms that support Ukraine in the war.

According to Proofpoint’s previous research, this group targeted elected government representatives in the US and their staffers.

1.  NATO Data Stolen in Cyberattack on Portugal
2.  Smartphones of NATO soldiers hacked by Russia
3.  Vulnerability found in NATO, EU-approved firewall
4.  NATO Probes Top Missile Firm MBDA Data Breach
5.  Russians hide Graphite malware in PowerPoint files

Zimbra email platform vulnerability exploited to steal European govt emails

By Habiba Rashid
Italy has given OpenAI, the parent company of ChatGPT, a deadline of 20 days to sort out privacy issues, including data collection, under Europe's General Data Protection Regulation (GDPR).
This is a post from HackRead.com Read the original post: Italy Temporarily Blocks ChatGPT, Citing Privacy Issues

The ChatGPT ban comes just days after OpenAI acknowledged privacy breaches in which private conversation histories of free users and payment data of ChatGPT Plus were exposed.

Artificial intelligence (AI) technology is rapidly becoming an integral part of our daily lives. From personal assistants to chatbots, AI technology is constantly evolving and changing the way we interact with the world around us.

One such AI chatbot that has been making waves in recent years is ChatGPT. However, Italy’s data protection agency has recently announced a temporary block on ChatGPT within the country’s borders, citing insufficient safeguards for user data and a lack of measures to prevent minors from using its generative AI service. Italy has also launched an investigation into the matter.

OpenAI, the parent company of ChatGPT, has a deadline of 20 days to comply with the order under the General Data Protection Regulation (GDPR) of Europe. Failure to do so could result in fines amounting to 4 percent of global revenue or €20 million, whichever is higher.

Italy’s complaints against ChatGPT are difficult to argue with. OpenAI recently experienced a glitch that exposed the private conversation history titles of its users. Later on, the company admitted that the breach was more significant than it had initially estimated, revealing that the payment card data of ChatGPT Plus subscribers had also been exposed.

There is also a complete lack of gatekeeping for minors, which is a significant concern. Another significant issue with ChatGPT and other AI chatbots like it is the issue of “training” the AI itself.

ChatGPT and other AI chatbots learn to mimic human behaviour by analyzing online content without the permission of the people who wrote it. ChatGPT can provide personal information about individuals but often makes mistakes, and those individuals have no way to correct these inaccuracies.

The ban on ChatGPT in Italy highlights the growing concerns about data privacy and the role of AI in our lives. Policymakers across the world are grappling with how to respond to the rise of AI products and the enormous amounts of data they consume from tens of millions of users worldwide. The move by Italy’s data protection agency could be the first of many regulatory actions against popular chatbots and AI services.

OpenAI has stated that it is committed to protecting people’s privacy and believes it complies with GDPR and other privacy laws. However, the temporary block on ChatGPT in Italy highlights the need for stronger data protection measures and the importance of ensuring that AI services are held accountable for their actions.

As the use of AI technology continues to grow, it is crucial that we continue to monitor and regulate these services to ensure that they are used ethically and responsibly.

1.  Russia Bans WhatsApp, Discord, Telegram, and Others
2.  Data collected in gaming can be used for privacy breach
3.  Lithuania to citizens: Dump Chinese phones over privacy

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Italy Temporarily Blocks ChatGPT, Citing Privacy Issues

By Waqas
For now, Cylance ransomware is still in its early stages, yet it has already claimed several victims.
This is a post from HackRead.com Read the original post: New Cylance Ransomware Targets Linux and Windows, Warn Researchers

Do not confuse Cylance Ransomware with the Blackberry-owned Cylance cybersecurity company.

The cybersecurity researchers at Palo Alto Networks Unit 42 have discovered a new strain of Cylance Ransomware, which has already claimed several victims. Researchers noticed it early Friday morning, and further probing revealed that it is targeting Linux and Windows devices.

As of now, insufficient information is available about Cylance Ransomware, indicating that it is a relatively recent emergence. The ransom note received by victims was published by Unit 42 which contains the attackers’ email addresses, but surprisingly not the ransom amount. Here is the content of the ransom note:

“All your files are encrypted, and currently unusable, but you need to follow our instructions. Otherwise, you can’t return your data (never. It’s just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities – nobody will cooperate with us. It’s not in our interests.”

“To check the ability of returning files, we decrypt one file for free. That is our guarantee. If you will not cooperate with our service – for us, it does not matter. But you will lose time and data, cause just we have the private key. time is more valuable than money.”

It is believed that the amount will be disclosed to the victim when they contact the attacker. The attackers have warned against any attempt to restore or change the files, as it would destroy the private key, which means the data will be lost forever.

**Attack Methodology**

In a tweet, researchers explained that the modus operandi of the ransomware attack involves encrypting files and appending them with a “.Cylance” extension. In addition, a text file titled “Read Me” is added to all encrypted files’ folders. This file contains the attacker’s ransom note.

**Who is Distributing Cylance Ransomware?**

For your information, Cylance is actually a cybersecurity company owned by BlackBerry Ltd. The company is known for mitigating and preventing ransomware attacks on enterprise organizations. However, why threat actors named the ransomware after this company is unclear, or it could be that they are looking for extra attention or to negatively impact Cylance in the long run.

Although Cylance ransomware is still in its early stages, it will be crucial to monitor its targets and wait for more information from the infosec community. Currently, samples of the ransomware are available on MalwareBazaar, a project by abuse.ch that shares malware samples with the infosec community, AV vendors, and threat intelligence providers.

1.  95.6% of Malware in 2022 Targeted Windows
2.  Lessons from Holy Ghost ransomware attacks
3.  CryWiper poses as ransomware to target Russia
4.  Royal Ransomware: New Threat Uses Google Ads
5.  Alert against AXLocker, Octocrypt, Alice ransomware

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Source

HackRead