Cyber World News

  The source code for Microsoft’s Windows XP operating system (and other versions) has been leaked online!  Published as a torrent file on bulletin board website 4chan, the 43GB data dump is said to have been compiled over the course of the last few months by the leaker. The collection also includes source code for Windows 2000 and multiple versions of Windows CE, MS DOS, Windows Embedded and Windows NT - but all of which have a smaller modern install base than XP. The individual responsible for the leak also appears to bear Bill Gates a distinct grudge, dedicating a whole section of the torrent file to videos slandering the Microsoft founder.  The legitimacy of the leaked code has not yet been confirmed, but Microsoft has been made aware of the issue. Although support for Windows XP lapsed in 2014 - meaning the OS has not received security updates for a number of years - a surprising number of users remain loyal to the outdated operating system. As of last month, 1.26% o...

Chinese state-sponsored hacking group targets India and Hong Kong with a unique phishing attack designed to convince the target. The campaign uses multiple documents with the filename ‘Mail security check’ and “Boris Johnson Pledges to Admit 3 Million From Hong Kong” in the attack. The document with the name ‘Mail security check’ targets India and the document with “Boris Johnson Pledges to Admit 3 Million From Hong Kong” targeting Hongkong. According to Malwarebytes  analysis , this new campaign is operated by a Chinese state-sponsored actor, who has been active since at least 2014. Spear-Phishing to Install MgBot Malware The campaigns found to be active since July 2, in the first campaign attacker group uses the Cobalt Strike variant delivered through a weaponized word document. A day after the first attack the APT group changed their template to drop, a loader called MgBot that make use of Application Management (AppMgmt) Service on Windows to deliver the final payload. The camp...

New Android malware has been discovered that steals data such as credit card details, password from 337 applications. This included some of the popular apps such as Amazon, Gmail, Uber, Netflix, and more. Highlights The malware was discovered by a mobile security firm Threatfabric. The malware is being distributed as fake Google update packages offered on third party websites. The malware is capable of performing intrusive operations such as Perform SMS floods, start specific apps, show custom push notifications, perform SMS floods, sabotage mobile antivirus apps. About the malware The malware is based on the leaked source code of another malware Xerxes. Again, xerxes is based on the strains of other malwares. Blackrock is completely enhanced with stealing passwords and credit card details. It collects data through overlays. Working of the malware The Malware asks for credit card setails and login credentials before the user enters the app. It asks for phone’s accessibility feature. It...

Something normal happened on Twitter earlier this afternoon. Someone claiming to be Elon Musk started tweeting an obvious scam to entice his loyal bootlickers to send bitcoin to a random cryptocurrency wallet. This happens all the time, but the strange thing about today was that the tweets were coming from Musk’s  verified account . And nearly identical tweets were coming from accounts of people like Bill Gates, Jeff Bezos, Kanye West, Joe Biden, Barack Obama,  Warren Buffett,  every major crypto-exchange , and I’m quickly losing track of all of ‘em. This is obviously the result of a Twitter hack the likes of which we’ve never seen before. A spokesperson for the social network told Gizmodo that they are aware of the situation and will issue a statement shortly, which they did right before publication. The hackers appear to be using a number of different wallets but the address being used on tweets from Musk and Gates has received around $59,000 worth of bitcoin so far. Th...

According to a new report, 127 home routers developed by seven different large vendors affected with multiple critical security flaws. The examination was done by researchers on several aspects such as firmware updates, operating systems, known critical vulnerabilities, and Cryptographic functions. The study says there is no single router without known critical vulnerabilities, the research conducted by Germany’s Fraunhofer Institute for Communication, Information Processing and Ergonomics (FKIE) and looked at 127 router models from ASUS, AVM, D-Link, Linksys, Netgear, TP-Link, and Zyxel. Home Routers Affected More than 90% of the router running Linux OS, one-third of the routers running with an older version of Linux kernel version(2.6.36) updated in 2011. The routers found to be affected with 53 critical-rated vulnerabilities, the worst-case regarding high severity CVEs is the Linksys WRT54GL powered by the oldest kernel. “AVM does a better job than the other vendors regarding most a...

Once again, Cerberus malware has emerged as a threat to users after appearing on the Google Play Store. The malware posed as a cryptocurrency converter app to trick users, thus reaching thousands of downloads. Cerberus Posing As Cryptocurrency App Researchers from Avast found Cerberus malware appearing on Google Play Store. The malware hid behind a cryptocurrency converter app. As explained in their post, the app seemingly aims at Spanish users. It bears the name “Calculadora de Moneda” which translates as “Currency Calculator” in English. Considering the niche chosen, it seems that malware basically attempted to steal users’ banking data, which the users would need to enter while converting their cryptocurrency to fiat money. Briefly, the researchers observed that the app remained harmless for a few initial weeks, seemingly to gather users (or victims). This also allowed the app to escape security check by Google Play Protect. However, the app did bear malicious malware dropper code w...

Lucifer Malware Targeting Windows Researchers from Palo Alto Networks’ Unit 42 division have found an active campaign of new malware in the wild. Dubbed ‘Satan’ by the threat actors, and ‘Lucifer’ by the researchers this malware exploits known bugs to infect Windows machines. Sharing the details in a post, the researchers explained that they caught two strains of Lucifer while analyzing the campaign. Yet, their functionalities predominantly remained the same, version 2 is more advanced. Briefly, Lucifer malware aims at cryptojacking by dropping XMRig on target devices, and DDoS attacks.  Moreover, the other functionalities are slightly different for the two versions. The Lucifer v.1 performs cryptojacking, DDoS attacks, brute-forcing credentials, and self-propagation. Whereas, Lucifer v.2, in addition to these capabilities, also exhibits anti-sandbox and anti-debugger functionalities. Also, the malware tends to drop EternalBlue, EternalRomance, and DoublePulsar backdoors (under cer...

Tycoon Ransomware – New Java Based Ransomware Attack Windows & Linux Users Security experts have warned that hackers are using a new multi-platform Java ransomware “Tycoon” to target Windows and Linux users to lock down the files. We all know that hackers are constantly looking for new means to attack data centers and systems of normal users to steal essential data and information. Since Microsoft Windows is the most used OS, that’s why hackers are making it as their target. hackers are paying more and more attention to other operating systems as well, like macOS and Linux.  As hackers are betting massively on multi-platform malware and ransomware, that affects all the major platforms. The main goal of this critical vulnerability is to infect the SMBs in the software and education industries. Tycoon Ransomware Security experts at BlackBerry  Research  and Intelligence Team in association with KPMG’s UK Cyber ​​Response Services have named this ransomware as “Tycoon,” ...

Kali Linux 2020.2: New look, new packages, new installer options Offensive Security has  released  Kali Linux 2020.2, the latest iteration of the popular open-source penetration testing platform. Kali Linux 2020.2 changes There are several cosmetic changes in this newest  Kali Linux  release: Dark and light themes are now available for the KDE Plasma desktop environment The login screen got new graphics and a new layout New package logos for each tool Other changes include: PowerShell has become more accessible: it has been moved from the Kali Linux’s network repository to the  kali-Linux-large  metapackage, meaning that it will be ready for use if users choose to install this meta-package during system setup or later, once Kali is up and running (through a simple command) After  recently  switching the default “root/toor” credentials to “kali/kali” for desktop images and making the default user account a standard, unprivileged (non-root) user, Of...