PLANCK기술 소식
보안 · 통신 기술 분야 공식 매체의 RSS에서 매일 8시 · 17시에 제목과 짧은 요약을 모읍니다. 본문은 각 매체 사이트에서 읽으십시오.
- Targeted ads installed Candiru spyware in zero-click attacks (새 창 · 바깥 사이트)
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]
EN BleepingComputer · 보안 · 2026.10.17 - Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor (새 창 · 바깥 사이트)
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows w…
EN The Hacker News · 보안 · 2026.10.17 - UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing (새 창 · 바깥 사이트)
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harves…
EN The Hacker News · 보안 · 2026.10.17 - When Your Ransomware Negotiator Works for the Other Side (새 창 · 바깥 사이트)
The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.
EN Dark Reading · 보안 · 2026.10.16 - Hackers disguise phishing as promising business opportunities (새 창 · 바깥 사이트)
Attackers are breaking into business email accounts with short messages asking whether a company can quote on an upcoming project, the kind of request sales and procurement staff answer every week. Cadence Riddle, a cybersecurity researcher at Fortra, tracked a 12-fold increase i…
EN Help Net Security · 보안 · 2026.10.16 - Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials (새 창 · 바깥 사이트)
CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login crede…
EN CISA Advisories · 보안 · 2026.10.16 - Fake Arch Linux AUR packages exploit typos to run malware with root privileges (새 창 · 바깥 사이트)
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted bu…
EN Help Net Security · 보안 · 2026.10.16 - Android adds AI-powered scam alerts, hangs up on bank impostors (새 창 · 바깥 사이트)
Google’s new scam protections cover Google Messages and third-party messaging apps, with an enhanced protection mode, expanded scam alerts and safeguards against call-forwarding and screen-sharing scams. “With scams growing harder to spot, it’s nearly impossible for users t…
EN Help Net Security · 보안 · 2026.10.16 - PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions (새 창 · 바깥 사이트)
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw…
EN The Hacker News · 보안 · 2026.10.16 - 코인 탈취를 위한 악성URL 유포에 따른 스미싱 주의 (새 창 · 바깥 사이트)KISA 보호나라 보안공지 · 보안 · 2026.10.16
- F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud (새 창 · 바깥 사이트)
Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime.
EN Dark Reading · 보안 · 2026.10.16 - Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers (새 창 · 바깥 사이트)
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
EN BleepingComputer · 보안 · 2026.10.16 - Android gets AI defenses against messaging scams, fake calls (새 창 · 바깥 사이트)
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
EN BleepingComputer · 보안 · 2026.10.16 - ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More (새 창 · 바깥 사이트)
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A truste…
EN The Hacker News · 보안 · 2026.10.16 - Fake Arch Linux packages push malware with root privileges (새 창 · 바깥 사이트)
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
EN BleepingComputer · 보안 · 2026.10.16 - Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads (새 창 · 바깥 사이트)
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the momen…
EN The Hacker News · 보안 · 2026.10.16 - Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams (새 창 · 바깥 사이트)
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code tem…
EN The Hacker News · 보안 · 2026.10.15 - Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early (새 창 · 바깥 사이트)
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure o…
EN The Hacker News · 보안 · 2026.10.15 - Yam Store: The Phishing Network Behind a Billion Messages (새 창 · 바깥 사이트)
A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide.
EN Dark Reading · 보안 · 2026.10.15 - Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App (새 창 · 바깥 사이트)
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes a…
EN The Hacker News · 보안 · 2026.10.15 - Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages (새 창 · 바깥 사이트)
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix…
EN The Hacker News · 보안 · 2026.10.15 - U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud (새 창 · 바깥 사이트)
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals f…
EN The Hacker News · 보안 · 2026.10.15 - U.K. Sanctions Cryptomus for RU Money Laundering (새 창 · 바깥 사이트)
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent ex…
EN Krebs on Security · 보안 · 2026.10.14 - Ransomware Gangs Embrace Physical Threats, Family Stalking? (새 창 · 바깥 사이트)
Organizations are reporting that employees face threats of stalking, physical violence, and abduction. But these alarming claims are hard to verify.
EN Dark Reading · 보안 · 2026.10.14 - North Korea Phishes Ukrainians for War Intel (새 창 · 바깥 사이트)
The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.
EN Dark Reading · 보안 · 2026.10.14 - Prominent Ransomware Negotiator Faces Extortion Charges (새 창 · 바깥 사이트)
Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.
EN Dark Reading · 보안 · 2026.10.13 - FBI Arrests Executive at Ransomware Negotiation Firm (새 창 · 바깥 사이트)
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sou…
EN Krebs on Security · 보안 · 2026.10.10 - 금융권 등 개인정보 유출 사고 피해보상금 지급 등 사칭 피싱 주의 권고 (새 창 · 바깥 사이트)KISA 보호나라 보안공지 · 보안 · 2026.10.06
- Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection (새 창 · 바깥 사이트)
Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse We’ve shared how Android’s proactive, multi-layered scam defenses utilize Google AI to protect users around the world from over 10 b…
EN Google Online Security Blog · 보안 · 2026.02.26 - New Android Theft Protection Feature Updates: Smarter, Stronger (새 창 · 바깥 사이트)
Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team Phone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're…
EN Google Online Security Blog · 보안 · 2026.01.28
제목과 요약의 저작권은 각 매체에 있습니다. PLANCK는 링크만 모아 보여 주며 내용을 고치거나 번역하지 않습니다. 피드(제목 · 링크)