Lifeboat Foundation

Researchers on Tuesday unveiled a major discovery—malicious firmware that can wrangle a wide range of residential and small office routers into a network that stealthily relays traffic to command-and-control servers maintained by Chinese state-sponsored hackers.

A firmware implant, revealed in a write-up from Check Point Research, contains a full-featured backdoor that allows attackers to establish communications and file transfers with infected devices, remotely issue commands, and upload, download, and delete files. The implant came in the form of firmware images for TP-Link routers. The well-written C++ code, however, took pains to implement its functionality in a “firmware-agnostic” manner, meaning it would be trivial to modify it to run on other router models.

A team of researchers from South Korea has developed a new LLM called “DarkBert,” which has been trained exclusively on the “Dark Web.”

A team of South Korean researchers has taken the unprecedented step of developing and training artificial intelligence (AI) on the so-called “Dark Web.” The Dark Web trained AI, called DarkBERT, was unleashed to trawl and index what it could find to help shed light on ways to combat cybercrime.

Continue reading “Meet ‘DarkBERT:’ South Korea’s Dark Web AI could combat cybercrime” »

Malicious Google Search ads for generative AI services like OpenAI ChatGPT and Midjourney are being used to direct users to sketchy websites as part of a BATLOADER campaign designed to deliver RedLine Stealer malware.

“Both AI services are extremely popular but lack first-party standalone apps (i.e., users interface with ChatGPT via their web interface while Midjourney uses Discord),” eSentire said in an analysis.

This vacuum has been exploited by threat actors looking to drive AI app-seekers to imposter web pages promoting fake apps.

Continue reading “Searching for AI Tools? Watch Out for Rogue Sites Distributing RedLine Malware” »

A computer based in Russia was able to breach the Washington, D.C., Metro system earlier this year, the Metro’s Office of the Inspector General (OIG) said in a new report.

The partially redacted report, released Wednesday and first reported by The Washington Post, said the Washington Metropolitan Area Transit Authority’s (WMATA) cybersecurity group detected “abnormal network activity originating in Russia” in January.

SideWinder, a state-sponsored group, uses a network of phishing domains to target government and financial sectors in Pakistan and China.

Water Orthrus group returns, leveraging pay-per-install networks to deploy the new CopperStealth & CopperPhish malware.

Join top executives in San Francisco on July 11–12, to hear how leaders are integrating and optimizing AI investments for success. Learn More

Patch management approaches that aren’t data-driven are breaches waiting to happen. Attackers are weaponizing years-old CVEs because security teams are waiting until a breach happens before they prioritize patch management.

Cyberattackers’ growing tradecraft now includes greater contextual intelligence about which CVEs are most vulnerable. The result: Manual approaches to patch management — or overloading endpoints with too many agents — leaves attack surfaces unprotected, with exploitable memory conflicts.

Distributed denial-of-service (DDoS) attacks are growing in frequency and sophistication, thanks to the number of attack tools available for a couple of dollars on the Dark Web and criminal marketplaces. Numerous organizations became victims in 2022, from the Port of London Authority to Ukraine’s national postal service.

Security leaders are already combating DDoS attacks by monitoring network traffic patterns, implementing firewalls, and using content delivery networks (CDNs) to distribute traffic across multiple servers. But putting more security controls in place can also result in more DDoS false positives — legitimate traffic that’s not part of an attack but still requires analysts to take steps to mitigate before it causes service disruptions and brand damage.

Rate limiting is often considered the best method for efficient DDoS mitigation: URL-specific rate limiting prevents 47% of DDoS attacks, according to Indusface’s “State of Application Security Q4 2022” report. However, the reality is that few engineering leaders know how to use it effectively. Here’s how to employ rate limiting effectively while avoiding false positives.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned today of a critical remote code execution (RCE) flaw in the Ruckus Wireless Admin panel actively exploited by a recently discovered DDoS botnet.

While this security bug (CVE-2023–25717) was addressed in early February, many owners are likely yet to patch their Wi-Fi access points. Furthermore, no patch is available for those who own end-of-life models affected by this issue.

Attackers are abusing the bug to infect vulnerable Wi-Fi APs with AndoryuBot malware (first spotted in February 2023) via unauthenticated HTTP GET requests.