WordPress Plugin Vulnerability Leads to Malware Installation

December 19, 2024December 19, 2024

Zero-Day Vulnerability in Hunk Companion Plugin Poses Serious Threat to WordPress Sites

A critical zero-day vulnerability in the popular WordPress plugin Hunk Companion is currently being exploited by cybercriminals, raising significant concerns for website security. Identified as CVE-2024-11972, this flaw allows unauthorized POST requests that can lead to the arbitrary installation of plugins, including outdated and vulnerable versions from the WordPress.org repository. With over 10,000 active installations, the Hunk Companion plugin, which facilitates customizable themes by ThemeHunk, is at risk.

Understanding the Hunk Companion Vulnerability

Researchers at WPScan first reported the Hunk Companion vulnerability, which has already been leveraged by attackers to install plugins with known exploits such as remote code execution, SQL injection, and cross-site scripting. These vulnerabilities can compromise targeted websites, making them susceptible to malicious attacks.

Key Details of the Vulnerability:

Flaw Identifier: CVE-2024-11972
Affected Versions: All versions prior to 1.9.0
Exploited Plugins: Attackers have been observed installing outdated plugins, including the WP Query Console, which has not been updated in over seven years.
Attack Method: Malicious PHP code is executed through a PHP dropper uploaded to the site’s root directory, creating a persistent backdoor for attackers.

Urgent Update Recommendations

Despite the release of version 1.9.0, which addresses this vulnerability, only about 1,800 out of 10,000 affected sites have been updated. This leaves approximately 8,000 sites still vulnerable to potential exploitation. The researchers are strongly urging all Hunk Companion users to update their plugins immediately to safeguard their websites against these threats.

Related Security Concerns

In addition to CVE-2024-11972, a previous related vulnerability, CVE-2024-9707, was patched earlier but proved insufficient as attackers successfully bypassed the fix. This highlights the ongoing risks associated with outdated plugins and the importance of regular updates.

For further information on WordPress security, consider reading our articles on best practices for securing WordPress and how to protect your site from vulnerabilities.

Conclusion

Website administrators must take immediate action to protect their sites from the ongoing exploitation of the Hunk Companion vulnerability. Regular updates and vigilant security practices are essential in maintaining the integrity of WordPress sites. If you have experienced issues or have thoughts on this vulnerability, please share your insights in the comments below or explore our related articles for more security tips.

Four Plead Guilty in US Government IT Bribery Case

January 16, 2025January 16, 2025

Four individuals have pled guilty to bribery and conspiracy related to government IT service contracts, as announced by the U.S. Department of Justice (DOJ). Contractor Brandon Glisson and government official Lawrence Eady admitted to bribery, while consultant Antwann Rawls and sales executive Scott Reefe confessed to conspiracy charges. They manipulated the bidding process to ensure contracts were awarded to their company, Alpha Greatness Omega, leading to an estimated $1.3 million loss for the U.S. government. Penalties vary, with Glisson and Eady facing up to 15 years, while further crackdowns on IT contractors involved in similar schemes are anticipated.

New Termite Ransomware Group Linked to Blue Yonder Hack

MetLife Rejects RansomHub’s Breach Allegations

January 2, 2025January 2, 2025

MetLife has denied being the victim of a cyber attack related to the RansomHub ransomware operation, despite claims of a significant breach involving the theft of 1 terabyte of sensitive data. The company confirmed that only its Ecuador-based subsidiary, Fondo Genesis, was affected by a “cyber incident,” asserting that its main systems remain secure. Leaked documents included internal logs and financial records from various Latin American countries. This incident follows a report of nearly 600,000 records exposed due to the MOVEit hack. MetLife emphasizes the importance of robust cybersecurity measures amid rising threats.

Crypto Heists Surpass $2B as Attacks Surge

December 20, 2024December 20, 2024

In 2024, cryptocurrency thefts surged, with $2.2 billion stolen across over 300 incidents, a 21% increase from 2023’s 282 thefts. Despite the substantial amount, the frequency and scale of heists decreased after major attacks on platforms like DMM Bitcoin and WazirX, which lost $305 million and $235 million, respectively. North Korean hackers were prominent, stealing $1.35 billion in 47 incidents, up from $660.5 million in 2023. Following a summit between Kim Jong Un and Vladimir Putin, attacks from North Korea declined, hinting at political influences on cybercrime. Enhanced security measures are crucial for protecting digital assets.

2025 Forecast: AI Threats Rise, Quantum Risks Increase, SaaS Woes

January 1, 2025January 1, 2025

As we approach 2025, the cybersecurity landscape is evolving significantly due to advancements in artificial intelligence (AI) and quantum computing. AI is expected to enhance threats like phishing and ransomware, with cybercriminals utilizing it for more personalized attacks and developing adaptive ransomware. Additionally, quantum computing poses risks to encryption, making sensitive data vulnerable and increasing cyber espionage. Insider threats will also rise, necessitating the adoption of zero trust strategies. However, AI can aid cybersecurity efforts through automated threat detection and streamlined incident response. Organizations must stay informed and proactive to navigate these challenges effectively.

FastHTTP Powers New Microsoft 365 Brute-Force Attacks

Sneaky Log Phishing Kits Target Microsoft 365 Accounts

January 18, 2025January 18, 2025

Cybersecurity experts have uncovered a new Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 accounts, capable of intercepting user credentials and bypassing two-factor authentication. Identified by researchers from Sekoia, this kit is sold as Phishing-as-a-Service (PhaaS) by the group “Sneaky Log” and has been active since October 2024. The kit features autofill functionality, obfuscation tactics, and evasion techniques, complicating detection. Traditional security measures struggle against its sophisticated methods, prompting recommendations for enhanced phishing protections, endpoint-level security, and AI utilization. Organizations must adapt their strategies to combat these evolving threats effectively.

North Korean Hackers Use OtterCookie Malware in Job Scam

December 27, 2024December 27, 2024

North Korean hackers have launched a new JavaScript malware called OtterCookie as part of their Contagious Interview campaign, which targets job seekers. The campaign uses social engineering tactics, posing as recruiters to trick individuals into downloading malware disguised as legitimate videoconferencing applications or npm packages. Palo Alto Networks Unit 42 identified the group behind these attacks, known as CL-STA-0240. Recent findings indicate that OtterCookie can execute shell commands and steal sensitive data, including cryptocurrency wallet keys. This campaign highlights ongoing cyber threats from North Korea, prompting sanctions from South Korea and indictments from the U.S. Department of Justice.