A variant of the AcidRain malware, used in Russian attacks on Ukrainian military communications and dubbed AcidPour, has surfaced recently. It exhibits enhanced features capable of disrupting various devices, indicating evolving cyber warfare tactics. Meanwhile, fresh threats hover over U.S. organizations from the operators of the PhantomBlu malware campaign. The attackers are leveraging advanced methods to evade detection and deploy the notorious NetSupport RAT, demonstrating the adaptability of threat actors in their pursuit of intrusions.

Despite ongoing efforts to patch, over 133,000 Fortinet appliances remain vulnerable to a critical flaw allowing RCE attacks, revealed security analysts. The majority of exposures are in Asia, with active exploitation reported.

Top Breaches Reported in the Last 24 Hours

Players equipped with cheats, game canceled

Electronic Arts (EA) postponed the North American finals of the Apex Legends Global Series e-sports tournament after two competitive players were hacked during separate matches. The hackers allegedly exploited an RCE bug to display cheat tools during the gameplay. The incident prompted organizers to suspend matches and issue warnings to participants regarding personal information security.

125 Million user records lay exposed

A significant data leak stemmed from misconfigured Google Firebase instances, starting with hacking Chattr, an AI hiring system used by various US organizations. Exploiting a weakness in Chattr's Firebase implementation, researchers identified 900 websites exposing data on 125 million users, including names, emails, phone numbers, passwords, and billing information.

Nations Direct Mortgage blurts out sensitive data

Nevada-based Nations Direct Mortgage disclosed a breach that affected over 83,000 customers. The inquiry established that an unauthorized third party gained access to and potentially extracted data belonging to specific individuals nationwide. The third-party may have obtained personal information such as names, addresses, Social Security numbers, and unique Nations Direct loan numbers.

Attack disrupts UK Defence Secretary's flight

The U.K Defence Secretary Grant Shapps' RAF Dassault Falcon 900 jet experienced a jamming attack allegedly launched by Russia while flying from Poland to the U.K. The attack disabled GPS and communications systems on the aircraft for almost 30 minutes near Kaliningrad, a Russian exclave neighboring Poland. Although the aircraft's safety was not compromised, the incident underscores Russia's interference with satellite communications.

Top Malware Reported in the Last 24 Hours

Wiping malware AcidRain introduces new variant

SentinelOne researchers have identified a new variant of the data-wiping malware AcidRain, named AcidPour, specifically tailored to target Linux x86 devices. This ELF binary, distinct from previous iterations, is designed to erase content from RAID arrays and Unsorted Block Image (UBI) file systems. While the exact targets remain unclear, SentinelOne has alerted Ukrainian agencies, highlighting the ongoing threat of wiper malware.

Malware campaign targets U.S. organizations

A sophisticated malware campaign dubbed PhantomBlu was found targeting U.S. organizations employing new TTPs to deploy the notorious NetSupport RAT. By leveraging OLE template manipulation and social engineering through email phishing, threat actors trick victims into downloading malicious documents containing hidden payloads. The malware, once activated, executes a PowerShell dropper to retrieve and execute the NetSupport RAT, establishing communication with C2 servers.

Top Vulnerabilities Reported in the Last 24 Hours

Many Fortinet appliances vulnerable to attacks

A month has passed since the discovery of a critical security flaw (CVE-2024-21762) in FortiOS. Still, the number of exposed Fortinet appliances remains alarmingly high, exceeding 133,000 globally. With Asia bearing the brunt of exposures, followed by North America and Europe, the vulnerability poses a severe risk of RCE and has been actively exploited. Authorities and experts warned of impending exploitation, underlining the urgent need for mitigation measures.

GPU side-channel attack via web browsers

Researchers from Graz University of Technology in Austria and the University of Rennes in France unveiled a novel GPU attack affecting popular web browsers and graphics cards. The attack exploits the WebGPU API, allowing malicious JavaScript code to execute high-performance computations on a user's GPU directly from a web browser. By leveraging GPU cache side-channel vulnerabilities, attackers can conduct inter-keystroke timing attacks, extract encryption keys, and establish covert data exfiltration channels.