Just when you thought the digital inferno couldn't blaze any hotter, Halcyon has unearthed a sinister new ransomware operator dubbed Volcano Demon, deploying a fiery variant known as LukaLocker. This ransomware encrypts files with the .nba extension, commandeering Windows systems using common administrative credentials.

In the relentless cat-and-mouse game of cyber defense, Google has fortified its defenses by patching 25 documented security vulnerabilities in the Android OS. The most perilous among them, CVE-2024-31320, poses a critical threat by potentially allowing privilege escalation on vulnerable devices.

Amidst the hum of office machinery, a quiet yet alarming revelation has surfaced: over 40 vulnerabilities have been discovered in Toshiba's e-STUDIO MFPs, impacting 103 models globally.

Top Malware Reported in the Last 24 Hours

New ransomware group pops up

Halcyon identified a new ransomware operator called Volcano Demon that is using a ransomware variant called LukaLocker. The ransomware encrypts victim files with the .nba file extension and uses common administrative credentials to lock Windows workstations and servers. The attackers cleared logs and exfiltrated data for double extortion before demanding payment through threatening phone calls. The ransomware also employs evasion tactics to stop various services and processes and uses the Chacha8 cipher for file encryption.

Top Vulnerabilities Reported in the Last 24 Hours

Google patches 25 Android bugs

Google patched 25 documented security vulnerabilities in the Android OS. The most severe issue is a critical-severity vulnerability (CVE-2024-31320) in the Framework component, which could allow an attacker to escalate privileges on a vulnerable device. The security update also addresses seven other high-severity issues, including three escalation of privilege bugs in Framework, three in System, and one information disclosure flaw in System.

Splunk patches 16 bugs

Splunk released patches for 16 vulnerabilities in its Enterprise and Cloud Platform, including six high-severity bugs. Three of the high-severity issues are remote code execution flaws requiring authentication, with one exploit affecting the 'splunk_archiver' application. Other vulnerabilities include command injection, path traversal, and denial-of-service flaws. Splunk also addressed medium-severity issues and provided information on third-party package vulnerabilities. There is no evidence of these vulnerabilities being exploited in the wild.

40+ vulnerabilities in Toshiba printers

Over 40 vulnerabilities have been discovered in Toshiba's e-STUDIO Multi-Function Printers (MFPs), affecting 103 different models used by businesses and organizations worldwide. The vulnerabilities include RCE, XML external entity injection, privilege escalation, authentication credential leak, DOM-based XSS, insecure permissions, TOCTOU (Time-of-Check to Time-of-Use (TOCTOU) conditions, and others. Affected MFPs run on Linux and can be leveraged by attackers to move laterally within infrastructures.