Amid a surge in global malicious threats, security researchers have noted a spike in P2Pinfect botnet traffic, suggesting active development and improvements by the authors. For instance, a variant of P2Pinfect tailored for MIPS architecture highlights a shift in focus toward routers, IoT devices, and embedded systems. Another malware strain, called TrickMo, has rejoined the banking trojan landscape to harvest credentials from targeted applications on Android devices. Dormant since September 2019, the malware has resurfaced with heightened capabilities, utilizing JsonPacker for code concealment.

Putting your system in deep waters is an Outlook flaw. The bug, which received a patch in March, is still being successfully exploited by one of the dreaded Russian cybercriminal groups. This privilege escalation issue allows attackers to access Net-NTLMv2 hashes and conduct relay attacks.

Top Breaches Reported in the Last 24 Hours

Ransomware actor extorts fintech firm

The ALPHV threat group claimed to have compromised Tipalti, an Israeli accounts payable software vendor. The group allegedly stole over 265GB of data belonging to the firm and its customers. The group reportedly had access to Tipalti's network since September 8, during which, it claimed to have exfiltrated confidential business data. The ransomware gang named Tipalti's clients, Twitch and Roblox, and stated its intention to extort them individually.

Iran-linked group claims attack on Israeli Hospital

The Malek Team, a hacking group linked to Iran, claimed responsibility for a cyberattack on Ziv Medical Center in Israel. The hackers allegedly possess 500GB of data, including medical records of Israeli soldiers, with over 700,000 documents leaked. The hospital has faced multiple cyberattacks in recent months. While Israeli authorities are investigating the incident, the hackers released evidence, including videos and passport scans.

Top Malware Reported in the Last 24 Hours

New P2Pinfect botnet variant spotted

Cado Security Labs researchers have discovered a new variant of the P2Pinfect botnet that specifically targets routers, IoT devices, and other embedded devices using 32-bit MIPS processors. This new variant aims to propagate via SSH brute-force attacks and by targeting devices running the Redis server on MIPS architecture. The bot’s updated mechanisms avoid execution in a VM and a debugger while supporting anti-forensics on Linux hosts. Since MIPS processors are common in embedded devices, it makes them potential targets for the botnet.

TrickBot resurfaces with 'TrickMo' variant

The TrickMo banking trojan has reemerged with a fresh variant. Initially identified in September 2019, TrickMo has returned with enhanced capabilities, leveraging JsonPacker to conceal its code. The latest iteration includes overlay injection, a more sophisticated technique compared to screen recording, for capturing details from targeted applications. TrickMo's expanded arsenal now includes 45 commands for compromising or exfiltrating sensitive data from victims' devices.

Top Vulnerabilities Reported in the Last 24 Hours

Zyxel addresses multiple sensitive bugs

Taiwanese networking equipment manufacturer Zyxel patched multiple vulnerabilities in its firewalls, access points, and NAS devices. The issues fixed include an improper input validation bug, a cross-site scripting (XSS) flaw, a privilege management flaw, buffer overflow vulnerabilities, and a pair of command injection vulnerabilities. Threat actors could exploit these vulnerabilities to steal cookies, access configuration files, execute operating system commands, and launch DoS attacks.

Kremlin-backed actors abuse Outlook flaw

Microsoft identified APT28 exploiting a critical security vulnerability in its Outlook email service to gain unauthorized access to victims' accounts within Exchange servers. The security bug in question is CVE-2023-23397, a critical privilege escalation bug patched by Microsoft in March 2023. The intrusions aim to obtain unauthorized access to mailboxes and modify folder permissions within victims' mailboxes, allowing the threat actor to read and extract valuable information.

Google patches zero-click RCE Android bug

Google released the December 2023 Android security updates, addressing 85 vulnerabilities, including a critical zero-click RCE bug tracked as CVE-2023-40088. The flaw is located in Android's System component and could be exploited by threat actors to achieve arbitrary code execution without user interaction. In addition to the zero-click RCE bug, the update addresses three critical severity privilege escalation and information disclosure vulnerabilities in the Android Framework and System components, as well as a critical flaw in Qualcomm's closed-source components.