A range of AMD processors are at risk of a new ZenHammer attack as researchers reveal that it can allow attackers to steal cryptographic keys from a system's memory. The CISA updated its KEV catalog with three new flaws, highlighting their exploitation in the wild. Two of these flaws impact products from Nice Linear and Fortinet. Federal agencies have been given a deadline of April 15 to address the flaws.

There’s a new addition to the growing list of phishing kits. Called Tycoon 2FA, the new kit is capable of mimicking login pages of several legitimate platforms, such as Microsoft 365 and Gmail, to steal credentials from users.

Top Breaches Reported in the Last 24 Hours

**The city of St. Cloud targeted **

The city of St.Cloud in Florida fell victim to a ransomware attack, forcing people to make cash payments at parks and recreation events. Additionally, payments for services at the Transfer station are temporarily being made in cash. Investigations are underway. The incident comes days after the city government of Pensacola and Jacksonville Beach confirmed suffering disruption due to ransomware attacks.

Giant Tiger suffers a data breach

A Canadian discount retailer, Giant Tiger, announced a third-party data breach that impacted the data of its customers. This includes names, addresses, phone numbers, and street addresses of email subscribers, and loyalty members of Giant Tiger. Additionally, the data of those who placed online orders for in-store pickup or home delivery were compromised in the incident. Customers are advised to be vigilant about suspicious emails and phone calls.

Top Malware Reported in the Last 24 Hours

**Rust-based Agenda ransomware **

Trend Micro observed that a Rust variant of Agenda ransomware is using RMM tools and Cobalt Strike to propagate to VMware vCenter and ESXi servers. It also spreads via PsExec and SecureShell, while also making use of different vulnerable SYS drivers for defense evasion. The ransomware continues to infect victims globally, including the U.S., Argentina, Australia, and Thailand. Most of the victim organizations are in the finance and law sectors.

Endoor backdoor spotted

Kimsuky group re-emerged in a new campaign that dropped Endoor backdoor disguised as an installer from a Korean public institution. The backdoor is developed in Golang and is capable of pilfering basic information from infected systems. It includes other features such as command execution, file upload and download, process-related tasks, and Socks5 proxy. As part of the campaign, the threat actor used the backdoor to download additional malware or install screenshot-taking malware, noted researchers.

Top Vulnerabilities Reported in the Last 24 Hours

New ZenHammer attack

Academic researchers demonstrated that CPUs based on recent AMD Zen architecture and DDR4 and DDR5 memory chips are vulnerable to a new variant of Rowhammer DRAM attack called ZenHammer. As part of the attack, attackers can exploit a physical characteristic of DRAM to gain access to memory and steal sensitive data such as cryptographic keys. AMD CPU users can defend against this threat by applying firmware updates.

CISA updates its KEV catalog

The CISA added three security flaws to its KEV, citing evidence of active exploitation. The flaws include an SQL injection vulnerability (CVE-2023-48788) in Fortinet FortiClient EMS, a code injection vulnerability (CVE-2021-44529) in Ivanti Endpoint Manager Cloud Service Appliance, and a command injection vulnerability (CVE-2019-7256) in Nice Linear eMerge E3-Series. In light of the active exploitation of these flaws, federal agencies are required to apply the recommended security patches by April 15.

Top Scams Reported in the Last 24 Hours

New Tycoon 2FA phishing platform

Researchers shared details of a newly discovered phishing-as-a-service kit named Tycoon 2FA, highlighting that it is widely used to target Microsoft 365 users and Gmail accounts. The kit, which shares similarities with Dadsec OTT and other AitM platforms, is capable of creating fake login pages of legitimate services to bypass MFA protections and exfiltrate credentials. The platform leverages 1,100 domains and has been observed in thousands of phishing attacks.