List of Data Breaches, Malware, Vulnerabilities, Scams, and Issued Patches in February 2018
February has registered several kinds of sophisticated malware, with hackers specifically aiming at generating file-less malware and variants of already existing ransomware/Trojans. Most of the malware (including Eviral, XMRig, and Rig EK) has been specifically designed to mine for cryptocurrencies. Critical vulnerabilities have been abundant and organizations have been busy releasing mitigation for them. However, on a positive note, Intel and other companies have successfully managed to release patches--for Meltdown and Spectre flaws--that mitigate the rebooting issue in different software and firmware. Scammers are continuously churning new methods and techniques to steal data, install ransomware, and generate revenue through malicious ad campaigns. Unsecured databases and lack of stringent authentication principles resulted in several breaches.
But there is good news: multiple security patches have been released by companies for several vulnerabilities. Users are advised to update their software, as per the list below.
Malware
Thanatos Ransomware Makes Data Recovery Impossible
Sophisticated Android malware spies on smartphones users and runs up their phone bill too
New Mirai Variant Focuses on Turning IoT Devices into Proxy Servers
Evrial: The Latest Malware That Steals Bitcoins Using the Clipboard
Six months on – Have we reached the other side of the Bad Rabbit hole?
Rig EK One Year Later: From Ransomware to Coin Miners and Information Stealers
XMRig: Father Zeus of Cryptocurrency Mining Malware?
Fileless Malware: What It Is and How to Stop It
Data Keeper Ransomware – An unusual and complex Ransom-as-a-Service platform
Avzhan DDoS bot dropped by Chinese drive-by attack
OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan
SWIFT Grift: Fake financial messaging service emails deliver Adwind RAT
Malicious RTF document leading to NetwiredRC and Quasar RAT
LockCrypt .1BTC Variant Installed Over Hacked Remote Desktop Services
Coldroot RAT Still Undetectable Despite Being Uploaded on GitHub Two Years Ago
Inside the Capabilities and Detection of UDPoS Malware
Rise of the 'Hivenet': Botnets That Think for Themselves
New Saturn Ransomware Actively Infecting Victims
Hidden Cobra malware infects Android devices with RAT, turns Windows machines into proxies
DoubleDoor IoT Botnet Abuses Two Bugs to Bypass Firewalls, Modems
Rapid Ransomware Being Spread Using Fake IRS Malspam
DexCrypt MBRLocker Demands 30 Yuan To Gain Access to Computer
Black Ruby Ransomware Skips Victims in Iran and Adds a Miner for Good Measure
DarkSky botnet spotted evading security measures
GandCrab Ransomware Being Distributed Via Malspam Disguised as Receipts
ShurL0ckr Ransomware Evades Malware Detection in Google Drive, O365
JenX botnet using video game to recruit IoT devices
Scarab ransomware: new variant changes tactics
Vulnerabilities
Adobe ReaderDC arbitrary code execution vulnerability found
Cisco NFV controller is a bit too elastic: It has an empty password bug
Facebook Flaw Exposed Page Administrators
SAML Vulnerability Lets Attackers Log in as Other Users
Oracle Server Vulnerability Exploited to Deliver Double Monero Miner Payloads
Flash Exploit, CVE-2018-4878, Spotted in The Wild as Part of Massive Malspam Campaign
'Critical' T-Mobile Bug Allowed Hackers To Hijack Users' Accounts
uTorrent vulnerabilities allow information disclosure and remote code execution
Facebook says two-factor SMS spam was caused by a 'bug'
Null Character Bug Lets Malware Bypass Windows 10 Anti-Malware Scan Interface
macOS May Lose Data Due to APFS Filesystem Bug
Oracle WebLogic Server Flaw Exploited to Deliver Crypto-Miners
Meltdown-Spectre flaws: We've found new attack variants, say researchers
Hackers have exploited a zero-day in Bitmessage client to steal Electrum wallet keys
Vulnerabilities in Apache CouchDB Open the Door to Monero Miners
Nine Remotely Exploitable Vulnerabilities Found in Dell EMC Storage Platform
Microsoft Edge CVE-2018-0771 Security Bypass Vulnerability
Telegram 0-Day Used to Spread Monero and Zcash Mining Malware
Multiple security flaws found in Netgear routers
A flaw in Hotspot Shield can expose VPN users, locations
CVE-2018-6389 WordPress Parameter Resource Consumption Remote DoS
Mission-critical system alert: 40-year-old OpenVMS hit by exploitable bug
Pulse Secure VPN vulnerability can allow MITM attacks
Unpatched DoS Flaw Could Help Anyone Take Down WordPress Websites
Oracle point-of-sale system vulnerabilities get Big Red cross
Scams
Massive Spam Campaign Targets Unpatched Systems
Malspam pushing Formbook info stealer - SANS Internet Storm Center
Hackers now exploiting Word documents to display 'innocent' videos that secretly mine cryptocurrency
Fake ASIC Renewal Spam Delivers Malware to Australian Companies
This phishing trick steals your email and then fools your friends into downloading malware
Hackers Email Bogus Tax Threats To Spread Ransomware
Watch out for these convincing App Store subscription phishing emails
IRS Scams Balloon Ahead of US Tax Day
Tech Legend Steve Wozniak Scammed Out of $70K in Bitcoin
Money Laundering Via Author Impersonation on Amazon?
Identity theft at center of new Mueller indictment
Edward Snowden returns to U.S.! Oops, nope, it's a phishing scam
Forget Email. Web Sites Use Notifications to Spam Your Browser Instead
Twitter Scammers Impersonate Celebs, Ask for Cryptocurrency
Be warned - new WhatsApp adidas giveaway is a hoax
T-Mobile Is Sending a Mass Text Warning of ‘Industry-Wide’ Phone Hijacking Scam
FBI warns hackers impersonating federal portal for reporting fraudsters
Surge in scams forcing consumers to exercise caution when scanning QR codes
New online financial scam costs victims $130K per attack
Breaches
Chinese websites targeted in drive-by download attack that drops DDoS bot
Australian universities and NGOs targeted by Iranian and Chinese hackers
India: 10,000 PNB Credit, Debit Card Customers Hit by Data Breach
3,000 Databases with 200 Million Unique accounts found on Dark Web
2,000 UVA Health System patients' information compromised
LA Times homicide site hacked to mine crypto-coins on netizens' PCs
SPH-owned HardwareZone Forum hacked; 685,000 users affected in Singapore’s largest data breach
Tesla Cloud Systems Exploited by Hackers to Mine Cryptocurrency
Hackers stole $6 million from Russian bank via SWIFT system: Central bank
Thousands of FedEx customer records exposed by unsecured server
Former ICE top lawyer raided US govt database to steal aliens' identities
Hacker extracts customer data from Canadian Telecom Firm after rebuttal
Thousands More Personal Records Exposed via Misconfigurations
Cryptojacking attack hits Australian government websites
Insurance Customers’ Personal Data Exposed Due to Misconfigured NAS Server
Reddit site spoofed by cyber-criminals to steal credentials of users
Hospital warns 24,000 patients that its EMR system was hacked to mine cryptocurrency
New IoT botnet infects over 20,000 devices using P2P communication
Key iPhone Source Code Gets Posted Online in 'Biggest Leak in History'
Analytics Firm Admits It Collected Password Data by Accident
Misconfigured Amazon Web Services bucket exposes 12,000 social media influencers
Leaked Document Appears to Show NSA Infiltrated Cryptos, Tor, VPN
Hackers breached BeeToken's email list and stole $1M worth of Ethereum
Confidential information of Batavia city employees, elected officials stolen in phishing scam
Russian hackers exploit weakness in US cyber defense
Patches
This month's Windows and Office security patches: Bugs and solutions
Several Vulnerabilities Patched in Drupal
GitLab Patches Domain Hijacking Vulnerability
Cisco Patches Critical Flaws in UCDM, ESC Products
Here We Go Again: Intel Releases Updated Spectre Patches
Trend Micro fixes serious vulnerabilities in Email Encryption Gateway
GitLab fixes security issue that let anyone hijack custom domains
Intel's new Spectre fix: Skylake, Kaby Lake, Coffee Lake chips get stable microcode
Several Vulnerabilities Patched in RubyGems
Apple patches iOS, macOS, tvOS, and watchOS for message crash bug
BGP Flaws Patched in Quagga Routing Software
SAP Resolves High Risk Flaws with February 2018 Patches
Critical Code Execution Flaws Patched in Android
Use Microsoft Outlook? Update now to fix these two dangerous bugs
Nokia 2 gets February security patch with fix for media framework vulnerability
After dismissing security flaw, Amazon patches Key smart lock anyway
Security Updates Available for Popular Netgear Routers
Linux Meltdown patch: 'Up to 800 percent CPU overhead', Netflix tests show
IBM Patches Spectre and Meltdown for Power Servers
Cisco updates router firmware to prevent remote code execution and denial of service attacks
XSS, SQL Injection Flaws Patched in Joomla
Oracle patches POS vulnerability affecting 300,000 systems
Multiple Flaws Patched in WD MyCloud Device Firmware
Siemens fixed three flaws in plant management product Siemens TeleControl Basic system