Patched yet unpatched! Security analysts have discovered ongoing scans and exploitation attempts for Apache RocketMQ services, owing to an unsuccessful patch issued in May 2023. More threats emerge from Iran like the Homeland Justice group that employed the No-Justice wiper malware in recent cyberattacks targeting Albanian entities, erasing data irreversibly. Meanwhile, another Iranian group introduces SilverRAT, signaling growing cybercriminal sophistication in the Middle East.

Quantum-safe encryption once again faces a credibility crisis as several security issues have been reported in the Kyber key encapsulation mechanism (KEM). Under certain conditions, it may allow cybercriminals to extract secrets and potentially compromise encryption from applications like Signal.

Top Breaches Reported in the Last 24 Hours

Sea Turtle APT launches espionage campaigns

A threat actor known as Sea Turtle, with a Türkiye nexus, launched a series of cyberattacks targeting telecommunication, media, ISPs, IT service providers, and Kurdish websites in the Netherlands. The group aims to collect politically motivated information, including personal details of minority groups and potential political dissidents. The stolen information is likely to be used for surveillance and intelligence gathering.

Mortgage lender hit, systems offline

loanDepot, one of the largest nonbank retail mortgage lenders in the U.S., suffered a cyberattack that led to the company taking IT systems offline. The attack affected the company's phone lines and online payment portal, preventing customers from accessing services. The company assured customers that recurring automatic payments would continue to be processed but advised using the contact center for new payments. The nature of the attack has not been disclosed yet.

Crypto exchange exposes KYC data

Bit24[.]cash, an over-the-counter crypto exchange in Iran, disclosed a data leak due to a misconfigured MinIO instance. Researchers discovered that the misconfiguration granted unauthorized access to S3 buckets containing the exchange's Know Your Customer data. Approximately 230,000 Iranian citizens were affected, with exposed data including written consent to regulations, passports, IDs, and credit cards.

Top Malware Reported in the Last 24 Hours

Homeland Justice deploys No-Justice wiper

Iranian cyber group Homeland Justice has launched a series of destructive cyberattacks on Albanian organizations, using a Windows-based wiper called No-Justice. ClearSky revealed that the malware crashes the operating system in a way that prevents it from being rebooted. The recent attacks, dubbed #DestroyDurresMilitaryCamp, targeted organizations, such as ONE Albania, Eagle Mobile Albania, Air Albania, and the Albanian parliament.

New SilverRAT strain by Iranian group

Anonymous Arabic, a cyber group with links to both Iran and Syria, developed a sophisticated remote access trojan malware called SilverRAT. The group plans to release an updated version that will enable control over compromised Windows systems and Android devices. Dubbed SilverRAT v1, the malware currently operates on Windows and allows the building of malware for keylogging and ransomware attacks.

Top Vulnerabilities Reported in the Last 24 Hours

KyberSlash flaws threaten Quantum-Safe encryption

Multiple implementations of the Kyber key encapsulation mechanism, designed for quantum-safe encryption, were found exposed to KyberSlash vulnerabilities. The flaws are timing-based attacks exploiting how Kyber performs certain division operations, allowing attackers to analyze execution time and derive secrets, potentially compromising encryption. Projects using Kyber, including Mullvad VPN and Signal messenger, are impacted. While patches have been issued for some, not all affected projects are fully secured.

Apache RocketMQ bugs exploited

Security researchers have detected ongoing exploitation attempts targeting Apache RocketMQ vulnerabilities, specifically CVE-2023-33246 and CVE-2023-37582. These vulnerabilities pose a risk of remote command execution and were initially identified in May 2023, but a complete fix was not achieved with the initial patch. The vulnerabilities impact the NameServer component in RocketMQ versions 5.1 and older. Attackers can exploit the flaws by executing commands through the update configuration function on the exposed NameServer without proper permission checks.