North Korea-linked threat actors are using poisoned Python packages to spread "PondRAT" malware as part of an ongoing campaign. Palo Alto Networks' Unit 42 found that PondRAT is a lighter version of "POOLRAT," also known as "SIMPLESEA," a macOS backdoor previously used by the "Lazarus Group" in attacks related to the 3CX supply chain compromise last year. This article continues to discuss findings regarding the new PondRAT malware.

The cybersecurity community started warning about remote hacker attacks on Automatic Tank Gauge (ATG) systems nearly a decade ago, but critical vulnerabilities remain. ATG systems are widely deployed in gas stations, monitoring the parameters in a storage tank, including volume, pressure, and temperature. In 2015, some cybersecurity companies found that ATGs could be remotely hacked, warning that honeypot data revealed hackers had targeted these devices. Earlier this year, researchers at Bitsight found that the situation regarding vulnerabilities and exposed devices has not improved.

CyberDanube, an Austrian industrial cybersecurity company, says hackers can take control of Riello Uninterruptible Power Supply (UPS) devices by exploiting unpatched vulnerabilities. The Italy-based Riello Elettronica is an electrical manufacturing sector company, leading in the UPS market. CyberDanube reports that the vendor has failed to fix two vulnerabilities in its NetMan 204 network communications card, which integrates Riello UPS systems into medium or large networks. The first issue is a SQL injection vulnerability that can modify log data without authentication.

SentinelLabs presented research at LABScon 2024 that brought attention to the resurfacing of "Kryptina," a Ransomware-as-a-Service (RaaS) tool, in enterprise attacks. The tool, which was initially available for free on dark web forums, has been adopted by "Mallox" ransomware group affiliates. The Kryptina platform, first released in December 2023, did not gain much attention among cybercriminals, but in May 2024, a Mallox affiliate leaked server data, revealing the use of a modified version of Kryptina to be used in Linux-based ransomware attacks.

Mandiant further explored "UNC1860," an Iranian Advanced Persistent Threat (APT) actor that serves as an initial access provider to high-profile networks in the Middle East. According to Mandiant, UNC1860 is a state-sponsored hacking group targeting Middle Eastern government and telecommunications entities. It shares similarities with other Iran-linked threat actors and appears to be affiliated with Iran's Ministry of Intelligence and Security (MOIS). This article continues to discuss findings regarding UNC1860's operations and tools.

According to a new mid-year cyber report from Ukraine authorities, Russian-aligned threat actors are shifting away from broad information-stealing campaigns across the country and toward cyber espionage targeting military infrastructure. Cyberattacks on Ukraine's security and defense sectors doubled between the second half of 2023 and the first half of 2024, according to an analysis by Ukraine's State Service of Special Communications and Information Protection (SSSCIP).

Carnegie Mellon University's (CMU) CERT Coordination Center (CERT/CC) published an advisory for a critical flaw, discovered by Amazon Element55's Andrue Coombes, in the Microchip Advanced Software Framework (ASF). The framework is a free and open source code library used for the company's microcontrollers. According to the US semiconductor supplier, the product is for evaluation, prototyping, design, and production. CERT/CC says the issue stems from ASF's implementation of the Tinydhcp server. It enables Remote Code Execution (RCE) using specially crafted DHCP requests.

According to security researchers at HP Wolf Security, cybercriminals are using a wider-than-ever range of malicious documents to spread malware and gain initial access to target systems.  The researchers noted that attackers are now prioritizing script-based phishing techniques over approaches based on traditional malicious documents.  The researchers found that 39.23% of malware deliveries came from an archive file in the second quarter of 2024, compared to 27.89% in the previous reported period.  

Arkansas City, a small city in Kansas, recently announced that its water treatment facility was forced to switch to manual operations while a cybersecurity incident is being resolved.  The cyberattack was discovered on the morning of September 22 and led to precautionary measures being taken "to ensure plant operations remained secure." According to city manager Randy Frazer, the water supply has not been affected, and the incident has not caused disruption to service.