Lifeboat Foundation

Australian businesses are paying untold amounts of ransom to hackers, but the government is hoping to claw back some visibility with a landmark cybersecurity law.

While major ransomware attacks on companies such as MediSecure, Optus and Latitude have grabbed headlines for breaching the privacy of millions, the practice of quietly paying off cybercriminals has flourished in the dark.

The situation has deteriorated to the point that the government’s original ambition for an outright ban on ransom payments has been nixed, for now, and the focus has shifted to mapping the scale of the problem.

Local decentralized energy systems, known as microgrids, can make urban infrastructures more resilient and reduce risks for the population, for example, in large-scale power outages due to natural hazards or cyberattacks.

In Nature Sustainability researchers from Karlsruhe Institute of Technology (KIT) present design criteria for microgrids that allow for fair treatment of different social groups alongside technical factors. The study shows how cities can shape the transformation towards a secure and more sustainable and equitable energy supply.

Climate change increases the probability of extreme events, as we have seen during the massive flooding of large parts of southern Germany in June. The question of how cities and municipalities can make power supply more resilient and more secure in the face of such crises is bringing so-called microgrids into focus.

Discover how the SeleniumGreed campaign exploits exposed Selenium Grid services for crypto mining, posing risks to automated testing frameworks.

CrowdStrike warns of targeted phishing campaign exploiting recent update incident. New threat actor targets German customers with fake installer.

Cybersecurity researchers have disclosed a privilege escalation vulnerability impacting Google Cloud Platform’s Cloud Functions service that an attacker could exploit to access other services and sensitive data in an unauthorized manner.

Tenable has given the vulnerability the name ConfusedFunction.

“An attacker could escalate their privileges to the Default Cloud Build Service Account and access numerous services such as Cloud Build, storage (including the source code of other functions), artifact registry and container registry,” the exposure management company said in a statement.

Google Chrome now warns when downloading risky password-protected files and provides improved alerts with more information about potentially malicious downloaded files.

These new, more detailed warning messages help users quickly learn the nature of the danger presented by each file downloaded from the Internet.

For this, Google introduced a two-tier download warning system that uses AI-powered malware verdicts sourced from its Safe Browsing service to help evaluate the actual risk quickly.

Meta has removed 63,000 Instagram accounts from Nigeria that were involved in sextortion scams, including a coordinated network of 2,500 accounts linked to 20 individuals targeting primarily adult men in the United States.

The social media giant said these accounts are linked to an organized cybercrime group called ‘Yahoo Boys,’ that has recently increased its operational volume.

Apart from the offending Instagram accounts, Meta has also deleted 1,300 Facebook accounts, 200 Facebook Pages, and 5,700 Facebook Groups, also based in Nigeria, that were handing out tips and training material for carrying out various scams.

Arid Viper launches mobile espionage campaign using trojanized Android apps to deliver AridSpy spyware, targeting Middle East users via fake messaging.

A Chinese organized crime syndicate with links to money laundering and human trafficking across Southeast Asia has been using an advanced “technology suite” that runs the whole cybercrime supply chain spectrum to spearhead its operations.

Infoblox is tracking the proprietor and maintainer under the moniker Vigorish Viper, noting that it’s developed by the Yabo Group (aka Yabo Sports), which has been linked to illegal gambling operations and pig butchering scams in the past. In late 2022, it rebranded as Kaiyun Sports and has since been absorbed into another newly formed entity called Ponymuah.

The suite, marketed in China as “baowang” (“包网,” meaning full package) encompasses several components such as Domain Name System (DNS) configurations, website hosting, payment mechanisms, advertising, and mobile apps. It also hosts thousands of domain names and numerous brands in an infrastructure that’s tied to Hong Kong and China.