https://blog.dansec.red/vendors/yara/Recent content in YARA on DanSec DailyHugoen-gbMon, 12 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-12-cybersecurity-news/Mon, 12 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-12-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Instagram has denied reports of a data breach after claims surfaced that data from over 17 million accounts was leaked online. The company stated that a bug enabling mass password reset email requests was identified and fixed, but asserts that no user passwords or sensitive data were exposed via a breach.</li> <li>The University of Hawaii Cancer Center confirmed that hackers accessed patient data. The institution did not immediately notify affected individuals and has withheld details regarding the specific research project compromised and any ransom payments made to regain access.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>The California Privacy Protection Agency has taken enforcement action against Datamasters, a marketing firm that sold the health and personal data of millions of users without registering as a data broker. California has now banned data brokers from reselling health data, tightening regulatory controls over the handling and sale of sensitive personal information.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>YARA-X version 1.11.0 has been released, introducing new hash function warnings to enhance detection capabilities for malware analysts and threat hunters.</li> </ul>https://blog.dansec.red/posts/2025-06-02-cybersecurity-news/Mon, 02 Jun 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-06-02-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>A spear-phishing campaign has been identified targeting Chief Financial Officers (CFOs) and other financial executives across six global regions. Attackers are distributing emails posing as recruiters and leveraging the legitimate remote access tool NetBird to establish persistent access to victims&rsquo; systems.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A trojanized version of the PuTTY SSH client has been observed in the wild. Attackers are distributing this malicious version to establish unauthorized remote access via a simple SSH backdoor.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Threat actors are abusing NetBird, a legitimate remote access tool, as part of their phishing campaigns against financial sector executives. This demonstrates continued use of legitimate tools for malicious purposes to evade detection.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Increased use of legitimate remote access software (NetBird) in targeted phishing campaigns against high-value financial targets.</li> <li>Ongoing abuse of trojanized open-source tools, specifically PuTTY, to deliver backdoors and maintain covert access.</li> </ul> <h2 id="tools-and-software-updates">Tools and Software Updates</h2> <ul> <li>YARA version 4.5.3 has been released, addressing five bugs.</li> </ul>