Threat Hunting

SecurityWeek reports that ASUS, ASRock, Gigabyte, and MSI had certain motherboards impacted by a new protection mechanism failure issue associated with UEFI implementations and the Input-Output Memory Management Unit, which could be leveraged to compromise data in memory and facilitate pre-boot code injection.

Threat actors have ramped up phishing campaigns harnessing Microsoft's OAuth device code authorization flow to compromise Microsoft 365 accounts since September, according to Infosecurity Magazine.

Organizations in the cryptocurrency sector have lost over $3.4 billion from heists between January and December, with North Korean hackers pilfering at least $2.02 billion, which is a $681 million increase from last year, reports The Record, a news site by cybersecurity firm Recorded Future.

Updated DocSwap Android malware deployed by Kimsuky Malicious QR codes and pop-up notifications on websites spoofing South Korean logistics company CJ Logistics have been used by North Korean state-backed advanced persistent threat operation Kimsuky to distribute the updated DocSwap Android malware, reports The Hacker News.

Threat group Jolly Scorpius has integrated double extortion capabilities into its updated RansomHouse ransomware-as-a-service platform, Cyber Security News reports.

HackRead reports Iranian advanced persistent threat operation Prince of Persia, also known as Infy, has reemerged with expanded targeting and a more sophisticated attack arsenal almost three years after it went on hiatus.

Over 1,800 suspected North Korean scammers had their attempts to obtain remote IT work at Amazon quashed since April 2024 as the firm recorded a 27% quarter-over-quarter increase in North Korea-linked job applications, The Register reports.