Heads up, WordPress admins! Ensure updating your websites at the earliest as a severe remote code execution (RCE) vulnerability threatens WordPress sites, triggering full website takeover. WordPress patched the flaw with the latest version 6.4.2.
A POP Chain Vulnerability In WordPress Could Allow RCE Attacks
WordPress recently released version 6.4.2 with a major security update. As explained in its advisory, this release addressed a critical code execution flaw allowing WordPress website takeover.
Specifically, WordPress Security Team discovered and patched seven different bugs affecting WordPress Core. One of these includes a security fix addressing a PHP code execution flaw. WordPress clarified that their team believes the flaw may pose a serious threat despite not being directly exploitable in core. Hence, they urge WordPress administrators to update their websites at the earliest to avoid potential threats.
While WordPress didn’t elaborate on the flaw, the security firm Wordfence shared a detailed analysis in their post.
As elaborated, the vulnerability was basically a Property Oriented Programming (POP) chain vulnerability. It affected the WP_HTML_Token class that was introduced in WordPress 6.4 for improved HTML parsing in block editor. The class includes a __destruct magic method, which allowed an adversary to exploit the flaw and take over the target website.
This __destruct method uses call_user_func to execute the function passed in through the on_destroy property, accepting the bookmark_name property as an argument… Since an attacker able to exploit an Object Injection vulnerability would have full control over the on_destroy and bookmark_name properties, they can use this to execute arbitrary code on the site to easily gain full control.
This vulnerability affects WordPress 6.4 to 6.4.1. To patch this issue, WordPress introduced a __wakeup method with version 6.4.2, which prevents the execution of the __destruct function.
Wordfence explained that WordPress doesn’t exhibit any known object injection vulnerabilities. However, such flaws are common in WordPress themes and plugins. Thus, an attacker may chain those plugins’ vulnerabilities with this flaw to achieve code execution.
Now that the vulnerability details are known publicly, it’s crucial for all users to update their websites immediately to remain safe from possible attacks.
How to pick out a replica trader might be explained in more particulars in the subsequent part. Even new buyers can use copy buying and selling as a end result of it’s a passive system. This means that you can depart the tough work of selecting investments to others. Earning returns in your portfolio is possible without spending hours researching the market. Since the professional trader directs funding choices, diversification and danger administration can also be done. There is no rule that you’ll want any previous experience to copy commerce.
Instead of automated trade execution, social buying and selling is supposed to enhance your buying and selling skills and assist you to turn into a greater trader of your own. Another method of increasing your chances of success is by copying multiple successful merchants with totally different trading systems. After all, diversification makes you less dependent on market conditions. For newbie merchants, it’s a good tool to generate buying and selling earnings, but they have to be sure the particular person you are copying knows what they’re doing. For different traders, copy trading is a great way to stay energetic in a market after they don’t have the time to commit to buying and selling themselves.
First, your success hinges on which investor’s actions you comply with. No investor is perfect in relation to understanding when to buy or promote or where to take a position. This makes many individuals favour mirror buying and selling over copy buying and selling, as all human error is removed from the equation. For example, the markets are continually evolving, which may end result in the algorithm running on outdated assumptions. When this occurs, the algorithm will take trades that now not work in the current surroundings, quickly blowing up your whole trading account.
Our website is focused on main segments in monetary markets – stocks, currencies and commodities, and interactive in-depth rationalization of key economic occasions and indicators. You ought to be really cautious in your selection of platform depending on how a lot management you want to have over the operations. You should also be careful which dealer you select – on the end of the day, you are entrusting part of your portfolio to a complete stranger. When acquiring our spinoff products you haven’t got any entitlement, proper or obligation to the underlying financial asset. AxiTrader just isn’t a financial adviser and all companies are provided on an execution only foundation.
Marco Monserrati (abbroush) – Low Risk Fairness And Fund Trader
So, when the copied dealer opens and closes a position, your account will routinely open and close the same position. SmartAsset Advisors, LLC (“SmartAsset”), a wholly owned subsidiary of Financial Insight Technology, is registered with the U.S. With this strategy, as an alternative of replicating an investor’s movements trade for trade, you’re mirroring their total investment type. In that case, you might choose to reflect Warren Buffett’s investment fashion. You may not necessarily purchase every investment he does or every funding he recommends. But you’d base your investing selections on the same ideas he follows.
Unlike social trading, copy trading isnt as reliant on the knowledge supplied by different traders as it is reliant on their actions. In other words, copy buying and selling allows you to copy the actions accomplished by other traders. In order for the method to be considered copy buying and copy trading system selling and not social trading, you must copy a trader using the automatic system supplied by the platform youre utilizing. For example, the trader with the best return might expertise huge drawdowns or might have a really brief buying and selling history.
When choosing an investor to observe, it’s necessary to evaluate their monitor record for consistent success over time. This evaluation helps determine if their fashion aligns together with your interests and risk tolerance. Cryptocurrencies are a relatively new entrant to the financial markets, offering volatility and profit potential. Many providers are shortly working to offer cryptocurrency copy trading on main crypto coins, including Bitcoin, Ethereum and Litecoin.
What A Duplicate Trader Should Know
Copy buying and selling is usually a good way to earn a revenue and make you rich, but it is very important understand that you will not become rich overnight. If you try to turn out to be rich too fast, you could have to copy very high-risk trades, and you will probably end up losing your money. If you use copy buying and selling to build wealth slowly, you ought to have a good probability of becoming a millionaire in due time.
If for whatever cause you don’t fancy using eToro on your copy trading endeavours – a selection of different options are on the table.
Huge advances in social buying and selling and the multiple social buying and selling networks means that is now freely available.
As there are heaps of devices to select from, every with its personal set of liquidity, volatility, and market exposure, some merchants might have their very own speciality.
Once you’ve acquired a signal, you’ll be able to then edit your settings and buying and selling parameters in line with your technique.
The latter two provide intelligent crypto copy buying and selling robots that rapidly execute market positions in real-time.
You ought to consider whether you perceive how CFDs work and whether or not you’ll be able to afford to take the high threat of shedding your cash.
For example, the news of rate of interest hikes has brought on volatility in crypto markets earlier than, which may trigger your position to get stopped out. Copying a trader that takes these components into consideration will allow you to survive during times of uncertainty. Finally, copy buying and selling lets you get exposure to markets you aren’t acquainted with yourself.
Copy Trading: The Last Word Beginner’s Information
As a outcome, copying them would theoretically let you do the same. You can do copy buying and selling on your own or through a replica buying and selling platform. Trades occur mechanically so there’s very little you have to do. Also, make certain there’s enough money in your trading account to cowl trade exercise. You ought to have a glance at how merchants are rated and have a glance at their buying and selling performance. All good social trading and replica trading platforms ought to have some sort of ranking system that can help you make an informed determination.
Currency ticker symbols are used within the forex market to symbolize the pair that’s being traded. A foreign money, such as the greenback, is rarely bought or offered in absolute phrases, however always in relation to another. Is the graphical representation of the signal provider’s account balance. Allows you to copy transactions made by one or more buyers inside a trading community. Is the fall in equity in a trader’s account, usually from a relative peak to a relative trough.
Step 2 Select One Dealer To Use The Copy Trading Strategy
Similarly, basic evaluation can be required to commerce effectively. This is the process of studying and decoding financial news developments and how they will impact the value of an asset. Research is by far the most important talent that you have to have as a dealer.
Below are three of the most popular buying and selling methods in the cryptocurrency house. Beyond numbers, followers should contemplate reading trader descriptions to understand their strategy and whether it aligns with their goals. Consider range by choosing merchants specialising in numerous tokens or sectors, strategies, holding intervals, and threat profiles. Imagine if you could open the same traders as skilled investors. Replicate the trading actions of monetary experts and earn a passive earnings with out spending time researching each investment you make. It can be a good idea to weigh the allotted cash primarily based on the chance profile of the copied trader.
As the name suggests, signals are basically indicators that followers can use to take a position on the markets. Once you’ve obtained a sign, you presumably can then edit your settings and trading parameters in line with your strategy. Signals have a tendency to offer extra flexibility than fastened and automated copy trading. You could want to edit your trade size, stop https://www.xcritical.com/ loss and take revenue levels before you execute trades. Copy trading permits you to connect part of your portfolio with someone else’s, the place any opened trades and future actions are mechanically copied to your account. This can be an effective way to diversify your investments; for instance, a dealer might consider following a long-term investor in the stock market.
Leading on from the above section, copy buying and selling can be great should you search a passive form of income. Once again, as quickly as you might have elected to copy your chosen trader – there could be nothing more so that you can do. Instead, the dealer will buy, sell, and trade monetary instruments in your behalf.
MoonXBT is known for its unbelievable pace of execution, according to its staff. If you didn’t find out about this, odds are you’ll have already stopped copying the trend-following system before a trend reveals up. But if you did your homework, you would be comfy, waiting for the following trending move to level out up.
An total favorite among merchants is the award-winning brokerage, eToro, which has been cited by quite a few on-line critiques. For those who want to use popular third-party platforms, AvaTrade or Pepperstone are also good selections. It’s important to contemplate how your individual buying and selling technique aligns to that of the providers you want to copy.
Researchers have devised a new attack strategy that threatens the security of future CPUs. Identified as SLAM attack, the attack targets the future CPUs from Intel, ARM, and AMD, exploiting their newly launched features to access sensitive information.
SLAM Attack Risks Data Leak In Future CPUs
Researchers from the Systems and Network Security Group (VUSec Group) at Vrije Universiteit Amsterdam, have identified a new exploit impacting the upcoming processors.
The researchers identify the new side-channel attack as “Spectre based on Linear Address Masking” (SLAM), which exploits the new security features in Intel (Linear Address Masking (LAM)), AMD (Upper Address Ignore (UAI)), and ARM (Top Byte Ignore (TBI)) chips. (The vendors have simply named the same feature differently for their respective CPUs. Hence, the SLAM attack similarly targets all the processors.)
Specifically, the SLAM attack is a transient execution technique exploiting the new memory improvement features to leak sensitive information, like password hashes. According to the researchers, SLAM exploits a “previously unexplored class of Spectre disclosure gadgets” that involve pointer chasing. The unmasked gadgets, unlike the Standard (masked) gadgets, are common code patterns across different software, and are even available with the Linux Kernel that doesn’t include masked gadgets.
It means SLAM – unlike other side-channel attacks – risks a wider range of systems, including Linux. In their study, the researchers emulated the Intel LAM feature on Ubuntu to demonstrate how the SLAM attack exploits the unmasked gadgets to leak arbitrary ASCII kernel data from a userland process.
The following video demonstrates the SLAM attack on Ubuntu, leaking password hashes.
Attack Duly Reported To The Respective Vendors
With SLAM attack, the researchers highlighted how the upcoming linear address masking feature may allow unmasked gadgets exploitation despite otherwise improving the security.
Following this discovery, the researchers reported the vulnerability to Intel, AMD, and ARM, making Intel and ARM release guidelines for the future processors. Linux developers also released patches to disable LAM until further guidelines arrive. Nonetheless, AMD didn’t release any guidelines, navigating to the existing Spectre v2 mitigations as their strategy to address SLAM.
The researchers have shared the details about the SLAM attack in a research paper accepted for the IEEE S&P’24, sharing the other relevant data on GitHub.
As if password authentication’s coffin needed any more nails, researchers in the UK have discovered yet another way to hammer one in. The technique, developed at Durham University, the University of Surrey, and Royal Holloway University of London, builds on previous work to produce a more accurate way to guess your password by listening to the sound of you typing it on your keyboard.
The slight differences in the sounds each key makes is an unintentional leak of information, known as a “side channel”. Computers typically have lots of side channels, such as noises, heat, and changes in electromagnetic emissions, which can be hoovered up and analysed by adversaries to learn more about what’s happening on the computer.
Side channel research can get a little far-fetched and impractical at times but it serves a useful purpose in improving our knowledge about what’s possible. However, this research is firmly rooted in the possible, starting with the decision to monitor sound, rather than something more exotic.
The ubiquity of keyboard acoustic emanations makes them not only a readily available attack vector, but also prompts victims to underestimate (and therefore not try to hide) their output. For example, when typing a password, people will regularly hide their screen but will do little to obfuscate their keyboard’s sound.
The researchers also used real-world attack scenarios, such as snooping on a laptop keyboard using the microphone on a smartphone in the same room, and by capturing the sound on a Zoom call.
As it is in so much cybersecurity research, Artificial Intelligence is centre stage. The new password-busting technique uses Deep Learning (a form of AI that mimics the learning process of the human brain) to determine which of a keyboard’s 36 keys are being pressed. The algorithm was taught using 25 presses on each key of an Apple laptop using different fingers and different pressures. The sounds from the key presses were processed extensively before being turned into images, and then fed into a deep learning algorithm used for image classification.
Did it work? Yes, even over Zoom.
The method presented in this paper achieved a top-1 classification accuracy of 95% on phone-recorded laptop keystrokes, representing improved results for classifiers not utilising language models and the second best accuracy seen across all surveyed literature. When implemented on the Zoom-recorded data, the method resulted in 93% accuracy, an improved result for classifiers using such applications as attack vectors.
Research like this always begs the question, should you be worried about this? Most people have far more basic password problems to concern themselves with before fixing their noisy keyboards. However, all targets of cybercrime are not created equal, and there are nation state agencies willing to spend millions to compromise specific people. It is not difficult to imagine an intelligence agency using a technique like this, and it isn’t too far fetched for industrial espionage either.
As the reseachers point out, a deep learning engine trained on one laptop could probably guess passwords on other laptops of the same model, meaning “a successful attack on a single laptop could prove viable on a large number of devices.” A hint that techniques like this could even be commodified one day.
If you are concerned about this it’s worth noting that entering a password with a password manager makes almost no sound. However, if you think you’re genuinely at risk from techniques like this you should be looking beyond passwords at things like passkeys anyway.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
You’re the admin for a large WhatsApp group chat, and you need to announce some major news. Guess what, that message about “Big changes coming to the company” just got washed away by the other messages raining into the group. This is frustrating, especially when that announcement is important. Well, your worries are over, as you can simply pin your messages to the top of your WhatsApp group chat.
If you’ve been wondering where this feature has been all your life, well, it’s been in testing. WhatsApp has been testing this feature for several months before bringing it to the masses. That’s also important to know in case you’ve been kicking yourself for not seeing it sooner.
So, how do you pin your WhatsApp messages? We’ll go over that in this piece. Also, we’ll talk about some other interesting things you can do in WhatsApp, so you’ll want to read to the end.
How to pin your WhatsApp messages
Pinning your messages in WhatsApp is pretty easy, but there are just a few things you’ll want to know about the feature. Firstly, pinning your messages will differ depending on what operating system you’re using.
If you’re using Android, then you’ll want to tap and hold on the message you want to pin. You’ll see a little menu pop up. Tap on the thumbtack icon. This will pin the message. If you’re using iOS, then the process is a little different. Instead of holding, you’ll just swipe your message to the right. This will bring up the menu with the Pin option.
Unpinning your messages is just as easy as pinning them. For Android, hold your finger down on the pinned message and you’ll see a thumbtack icon with a line through it. Tapping on that will push the message back to its original place in the message feed. For iOS, swipe right on that pinned message and tap on the Unpin button.
Other things you need to know about this feature
When you pin a long message, the app will truncate it. You’ll have to tap on it to see the full message. This helps in case you need to post an extended announcement.
You can pin any kind of message. Along with regular text-based chats, you can pin pictures, videos, and even polls. So, you’re not limited in what you can pin to the top of your group chat. That’s great because not all important messages are only text-based. People often need to send other forms of messages for their colleagues to see. Say, you need to share a large file with your employees with important documents; you can do that.
Something to know is that these posts are temporary. At the time of writing this article, there’s no way to pin a message permanently. When you’re pinning a message, you’ll have the option to have it stay up for 24 hours, 7 days, or 30 days. That can be a bit frustrating if you need something to stay for the duration of the group. However, here’s hoping that WhatsApp changes this. The message will be set to 24 hours by default.
Other cool things you can do with WhatsApp
WhatsApp is always testing and launching new features, and it’s so easy to miss a few. If you’re a WhatsApp user, then you might want to know about the features that are coming out for the platform. Here’s a quick rundown of what you can do.
Original quality media
Before, WhatsApp would heavily compress any media that you upload on the platform. This is something that’s always frustrated people who want to share important pictures on the platform. Well, that’s a thing of the past. The company now preserves the original quality of your media. If you don’t want to upload in the original quality for some reason, you can choose the quality of the pictures that you’re uploading.
At the time of writing this article, this ability is only available for iOS users. However, the feature is going to come to Android users.
View-once messages
This is a trend that was popularized by Snapchat messages. As the name suggests, when you receive a view-once message, you’ll only be able to view it once before it’s deleted. This means that, if you want to see it again, you’ll need to ask the sender to send it again.
This feature is useful for people who need to send important information that they don’t want to fall into the wrong hands. It’s very useful for people who work in high-level positions. Either that or it could just come in handy when you want to confess your undying love to someone.
Secret chats
This feature is actually several features that add to a more secure (or surreptitious) chatting experience. Firstly, there are locked chats that no one can access without a password. This feature comes in handy if you’re talking with a colleague about sensitive matters. High-level executives often have access to some seriously locked-down information pertaining to their company. This information needs to stay behind lock and key.
Now, WhatsApp used to have those chats visible in your chat feed. While other people couldn’t access them, it was still obvious that you had secret chats. This is why WhatsApp allows you to hide those locked chats with a secret code. Having locked chats is good, but if people can see that you have locked chats, they can become curious as to what you have to hide.
This feature will hide your locked chats from your chat feed. In order to access those chats, you’ll need to enter a secret code that you created. You’ll type that code into the search bar.
WhatsApp is always working on new features, so always be on the lookout for new and exciting additions to the platform.
Google Forms is the latest Google product to be abused by threat actors, this time for a new variant of the BazarCall attack
Cybersecurity researchers at Abnormal Security have identified a new attack campaign in which scammers use the BazarCall technique (BazaCall or Callback phishing) to target victims. This time, however, the notorious phishing attack method has taken a sophisticated turn by incorporating Google Forms to enhance its deceptive strategies.
Here, it is worth noting that Abnormal Security’s findings came just a couple of weeks after the FBI warned users of the Silent Ransom Group (SRG), also identified as Luna Moth, employing Callback phishing techniques for network hacks.
In the usual scenario, the BazarCall attack typically begins with a phishing email masquerading as a payment notification or subscription confirmation from familiar brands. The email prompts recipients to call a provided phone number to dispute charges or cancel a service, creating a sense of urgency. However, the real objective is to trick victims into installing malware during the phone call, exposing organizations to future cyber threats.
What sets this BazarCall variant apart is its utilization of Google Forms to elevate the authenticity of malicious emails. The attacker crafts a Google Form, adding details about a fake transaction, including an invoice number and payment information. The response receipt option is then activated, sending a copy of the completed form to the target’s email address.
In a blog post, Mike Britton Chief Information Security Officer at Abnormal Security that the attacker manipulates the process further by sending the form invitation to themselves, completing it with the target’s email address, and making it look like a payment confirmation for a product or service. Using Google Forms, sent from a legitimate Google address, enhances the attack’s legitimacy, making it harder to detect.
“Because the email is sent directly from Google Forms, the sender address is forms-receipts-noreply@googlecom, and the sender display name is “Google Forms.” Not only does this contribute to the appearance of legitimacy, it increases the chances of the message being successfully delivered as the email is from a legitimate and trusted domain.”
Mike Britton – Abnormal Security
The uniqueness of this BazarCall lies in its difficulty to be identified by traditional email security tools. Unlike typical threats with malicious links or attachments, this attack relies on Google Forms, a trusted service for surveys and quizzes.
Actual email sent by threat actors using Google Forms (Image credit: Abnormal Security)
The dynamic nature of Google Forms URLs further complicates detection, as they frequently change, evading static analysis and signature-based detection used by many security tools. Mike further noted that legacy email security tools, such as secure email gateways (SEGs), struggle to discern the malicious intent behind these emails, leading to potential threats slipping through the cracks.
However, modern AI-native email security solutions equipped with behavioural AI and content analysis can accurately identify and thwart such attacks by recognizing brand impersonation and phishing attempts.
In navigating the evolving landscape of cyber threats, staying informed about sophisticated attack methods like this BazarCall variant is crucial. Adopting advanced email security solutions that leverage artificial intelligence is paramount to effectively protect organizations and individuals from the ever-changing tactics of cybercriminals.
This article is based on research by Marcelo Rivero, Malwarebytes’ ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, “known attacks” are those where the victim did not pay a ransom. This provides the best overall picture of ransomware activity, but the true number of attacks is far higher.
In November there were 457 total ransomware victims, making it the most active month for ransomware gangs in 2023 so far besides May. The top stories of the month include ALPHV’s shutdown, an increased focus on the healthcare sector, and high-profile attacks on Toyota, Boeing, and more using a Citrix Bleed vulnerability (CVE-2023-4966).
We’ve written about a few ransomware gangs getting shut down this year, including Hive in January and RansomedVC in October, but ALPHV is the latest—and arguably biggest—name to be crossed off of law enforcements’ hit list in 2023. The fate of the gang was sealed in early December, when their data leak sites suddenly became unavailable. Shortly thereafter, researchers at RedSense confirmed that law enforcement was indeed behind the takedown action.
ALPHV’s shutdown represents a huge blow to the ransomware world—and a big win for defenders. With a total of 573 victims since February 2022, it’s no exaggeration to say that ALPHV was second only to LockBit in being organizations’ biggest ransomware threat. The demise of ALPHV can be examined through a few different lenses. For one, it’s a reminder that no ransomware gang—however prolific or well-resourced—is immune to downfall.
The good news in all this is that today’s who’s who can be tomorrow’s nobody. The bad news? That same logic works in reverse as well: Today’s nobody can be tomorrows who’s who.
This is the case we’ve seen with gangs like Medusa or 8BASE. For every head lopped of off the ransomware Hydra, it feels like three more grow in its place. However, none of this is to say that decisive law enforcement action doesn’t deter ransomware gangs to some extent—it does. One can hope that ransomware gangs see a Goliath like ALPHV get felled and think twice about wantonly attacking organizations at the rate we’ve been seeing lately.
In other news, attacks on the healthcare sector last month reached an all-time high at 38 total attacks.
The record follows a steady uptick in attacks on the sector we’ve observed over the past year. According to the findings released by the Department of Health and Human Services last month, there has been a 278% increase in ransomware attacks on health sector over the past four years. “The large breaches reported this year have affected over 88 million individuals, a 60% increase from last year,” the agency also said.
Ransomware attacks on healthcare, 03/22 to 011/23
An attack on Ardent Health Services last month stands as a devastating reification of the trend. The attack, which occurred on Thanksgiving Day, left emergency rooms in multiple hospitals across four US states shut down for five days.
What explains the rise and focus on attacks on the healthcare sector? Well, for one thing, there isn’t a clear bias of one gang disproportionately targeting health care—our data shows LockBit is consistently at the top of the list, as they are likely for most sectors. The explanation, then, likely resides in a combination of facts:
In other news, ransomware gangs rushed to exploit the Citrix Bleed vulnerability last month, taking advantage of a massive attack surface with over 8,300 vulnerable devices. LockBit led the fray by using the vulnerability to breach the likes of the Industrial and Commercial Bank of China (ICBC), DP World, Allen & Overy, and Boeing. Reported to have been in use as a zero-day since late August, Citrix Bleed provides attackers with the capability to bypass multi-factor authentication (MFA) and hijack legitimate user sessions. It is also said to be very easy to exploit.
Known ransomware attacks by gang, November 2023Known ransomware attacks by country, November 2023Known ransomware attacks by industry, November 2023
One of the most interesting developments last month were new reports reinforcing claims that Rhysida may be a rebrand of the infamous Vice Society ransomware gang. Not only does Rhysida share many operational and technical patterns with Vice Society—including using NTDSUtil for backups in ‘temp_l0gs’ and SystemBC for C2 communications—but the distribution of their monthly attacks lines up as well. Vice Society hasn’t been active since June 2023—the same month we witnessed the rise of Rhysida.
Vice Society vs Rhysidia monthly ransomware attacks. Rhysida seems to pick up right where Vice Society dropped off
That being said, a rebrand isn’t confirmed. Perhaps Rhysida is a splinter group. Whatever the explanation, however, it’s almost certain this pattern is no mere coincidence—especially considering the victimology of the two groups is extremely similar (a focus on education and healthcare sectors).
New Player: MEOW
First detected in August 2022, Meow ransomware, linked to the Conti v2 variant, reappeared after vanishing in February 2023. The group published nine victims to its leak site in November.
Operating as MeowCorp or MeowCorp2022, it encrypts files with a “.MEOW” extension and sends ransom notes demanding contact via email or Telegram. Using ChaCha20 and RSA-4096 encryption, Meow is related to other malware strains originating from the leaked Conti variant. Its dark web site shows a limited victim list, including the high-profile entity Sloan Kettering Cancer Center.
ThreatDown Bundles combinesthe technologies and services that resource constrained IT teams need into four streamlined, cost-effective bundles that take down threats, take down ransomware gangs:
ThreatDown Core Bundle: Next-gen AV and threat surface reduction. A simple yet superior solution integrating award-winning endpoint protection technologies.
ThreatDown Advanced Bundle: Everything included in core plus Managed Threat Hunting and Ransomware Rollback. Tailored for smaller security teams with limited resources.
ThreatDown Elite Bundle: Everything in Advanced plus 24/7/365 expert monitoring and response by Malwarebytes MDR analysts. Purpose-built for organizations with small (to non-existent) security teams that lack the resources to address all security alerts.
ThreatDown Ultimate Bundle: Everything in Elite plus protection from whole categories of malicious websites. Perfect for teams looking for a one-and-done shortcut to cybersecurity done right.
Samsung‘s smartphone division may be planning a major strategy overhaul for 2025 and beyond. Not just design changes, but the company appears to be evaluating a couple of unique devices too. A fresh rumor says it is considering adding a more powerful model to the Fan Edition (FE) lineup, like a compact Ultra flagship. Samsung is also exploring an affordable foldable smartphone, aka Galaxy Fold Lite.
Samsung may introduce a compact Ultra FE phone in a few years
In 2019, Samsung made several strategic changes to its budget and mid-range Android smartphone lineups. It led to the formation of the current A series, which is among the world’s best-selling phones. Starting next year, the firm is looking to change a few things in its flagship lineup, including foldables. The Galaxy Z Fold 6, Galaxy Z Flip 6, and Galaxy S25 series are said to bring notable design changes.
After that, Samsung reportedly plans to consolidate its low-cost phones, which are currently sold under the A, M, and F series. However, the strategic overhauling of Galaxy smartphones doesn’t end there. According to a new report coming from Korea, the company is looking to add a more powerful model to its FE lineup, which is known for offering flagship-grade specs at a more affordable price.
The current configuration of three flagship S-series models—base, Plus, and Ultra—will continue at least until 2027. But Samsung plans to introduce an Ultra-type FE phone to the market in a few years. It will be smaller than the regular Ultra flagship in size but will pack similarly powerful specs. Maybe an S Pen too. The Korean behemoth seems to be taking a cue from Apple’s “Pro” iPhones.
An affordable Galaxy foldable may be on the cards too
Samsung recently denied reports that it is working on “mid-range foldables.” However, that doesn’t necessarily mean it isn’t exploring ways to make foldable phones cheaper—not quite down to the mid-range-level pricing but more affordable than the current models. The new report says it has readied two prototypes of the Galaxy Fold Lite, which may not be the official name of the product.
One of those doesn’t have an external screen. The other does feature a cover display but it is smaller than the tall panel found on the first-gen Galaxy Fold. The product appears to be in a very early stage of research and development. Samsung may or may not proceed to launch it. Even if it does, we may not see an affordable or smaller Galaxy foldable hit the market before 2025.
Xbox truly is trying to bring games to any screen and any device, and has now just launched a beta version of Xbox Cloud Gaming for Meta Quest headsets. The app will be compatible with Meta Quest 2, Meta Quest 3, and Meta Quest Pro, and you can download it on your headset right now if you feel like diving in.
You will still need a subscription to Xbox Game Pass Ultimate to use the app. But this lets you experience your cloud games in a whole new way. On a massive virtual screen. Microsoft says you’ll need an Xbox controller and a high-speed internet connection. Your headset also has to be updated to the latest software. If you meet that criteria then you can check out hundreds of games in a totally new way. Imagine playing Starfield in VR on a screen that’s much bigger than you physically have.
Xbox cloud gaming on Meta Quest will support multiple controllers
The fact that this is available is already a good value for Meta Quest headset owners. But what makes it better is that you can use a variety of controller types to play games. The Xbox Wireless controller will work of course. But you can also use the DualShock 4, a Nintendo Switch Pro controller, and some other supported Bluetooth gamepads. Meta and Microsoft both state that Bluetooth gamepads are needed. But, the list of controllers that are confirmed to have support is small.
With this in mind, you might not have a controller that works. But it’s still worth testing. The Verge notes that the PS5’s DualSense controllers won’t currently work. But Meta does confirm that support will be added in the future. Additionally, the app supports multiple screen size options. The app is available in a wide variety of languages from English to Korean. So no matter where you live there’s a good chance this will be available. Honestly, it should be available in regions where the app is already available on other platforms.
According to Ukrainian intelligence, its cybersecurity experts have destroyed databases and backups used by the Russian tax authorities.
The Ukrainian military’s Main Directorate of Intelligence (GUR) claims to have crippled Russia’s Federal Tax Service (FTS) through a sophisticated cyberattack. Apparently, the hackers backed by the agency infiltrated thousands of servers, destroying databases and backups, and disrupting communication between the central office and regional branches.
The breach reportedly encompassed not only the FTS itself but also a Russian IT company responsible for its data center services. Cybersecurity experts from the agency targeted the FTS and the IT company Office.ed-it.ru. The “paralysis” caused in the operation of the Russian system due to this attack may persist for at least a month, with full recovery nearly impossible, GUR said.
The directorate also stated that the attack has completely wiped out configuration files, rendering it inoperable. The primary database and backups were obliterated, leaving Russia struggling to recover vital tax data.
Screenshot shared by Ukranian authorities the the official website of the Federal Tax Service of Russia (ФНС). It says that the website is not working today, December 12, 2023. The message is in Russian language. The other screenshot shows a series of connection timeouts, apparently occurring at the taxation network in Russia:
Screenshot shared by Ukranian authorities the the official website of the Federal Tax Service of Russia (ФНС). It says that the website is not working today, December 12, 2023. The message is in Russian and says: “ФНС не работает сегодня 12.12.2023” (FNS ne rabotayet segodnya 12.12.2023).
The attack also severed communication between the FTS central office and its 2,300 regional branches, paralyzing nationwide operations. Ukraine’s hackers now control tax-related internet traffic across Russia, potentially granting them access to more sensitive information.
The attack took place recently during which military intelligence operatives penetrated the tax system’s central server as well as over 2,300 of its regional servers across Russia and occupied Crimea. It may cause several weeks or even months of disruption to tax collection and government operations.
It is worth noting that the cyberattack is just another one in a series of attacks carried out by Ukraine. A couple of weeks ago, in November, Ukraine claimed to have breached Russia’s top Aviation agency and announced “Aviation Cannibalism,” suggesting that the country’s aviation sector is collapsing.
Ukrainian media also reported a cyberattack on Russia’s Labor Ministry in November, allegedly launched by hacker group Blackjack and Ukraine’s SBU intelligence agency, resulting in the acquisition of sensitive data. However, the SBU has remained silent, leaving room for speculation and raising questions about the operation’s veracity and purpose.
On the other hand, a DDoS attack was launched on Kyivstar, a Ukrainian telecom provider, on December 12. Ukraine’s SBU Security Service suspects Russian intelligence involvement and has launched a criminal investigation. Kyivstar’s Director, Oleksandr Komarov, is still determining the restoration timeframe.
These events mark a significant escalation in cyber warfare between Ukraine and Russia. The attack on the Russian tax system is the second major cyberattack Ukraine claims responsibility for against Russian state agencies in recent months.
However, it is worth noting that while collaboration between the Ukrainian government and hacking groups is likely, we are still waiting for more details to determine the exact scope and modus operandi of this attack.
