Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Cyber Threat Intelligence

Cyware Monthly Cyber Threat Intelligence December 2018 - Featured Image

Monthly Threat Briefing Dec 28, 2018

The Good

As December comes to an end, so does 2018. The past year saw some incredible cybersecurity incidents and advancements. It is our pleasure to help you wrap up the last month of the year with some of the biggest cybersecurity news of December. As always, we begin by highlighting all the good that took place in cyberspace. A new bill has been introduced to the US Congress, which would allow hackers to report bugs directly to the Department of Homeland Security (DHS). Adobe Sign has updated its digital ID authentication feature aiming to enhance signer security using a smartphone or selfie. The Democrat Senate group has introduced Data Care Act to protect Americans’ information online. Meanwhile, Google is working on blocking the ‘Back button’ hijacking of Chrome browser.

  • A new bill has been introduced to the US Congress, which would allow hackers to report bugs directly to the Department of Homeland Security (DHS). The Public-Private Cybersecurity Cooperation Act, introduced Senators Rob Portman, and Maggie Hassan, requires DHS to create a permanent bug bounty program of sorts, that will ensure that hackers can report problems they find to the proper authorities without being prosecuted for breaking laws.

  • Adobe Sign has updated its digital ID authentication feature aiming to enhance signer security using a smartphone or selfie. It has also introduced a new signer identification feature called ‘Government ID Authentication’, that allows users to snap a photo of their driver’s license or passport as a form of digital ID authentication.

  • The Democrat Senate group has introduced Data Care Act to protect Americans’ information online. The Act would require websites, apps, and other online providers to take responsibility for protecting personal sensitive information and preventing the misuse of users’ data.

  • Google is working on blocking the ‘Back button’ hijacking of Chrome browser. Google engineers are currently working on an update that will block malicious websites from hijacking the Chrome browser's history and, indirectly, the Back button.

  • Cybersecurity and Infrastructure Security agency bill has been passed. The bill will replace the National Protection and Programs Directorate with the new Cybersecurity and Infrastructure Security Agency. The White House has agreed to a Senate version of the Cybersecurity and Infrastructure Security Agency (CISA) without opposition.

  • The UK government has announced a new standard for cyber security to protect driverless cars from hacking. This new standard is also designed to attract investment in the UK’s autonomous vehicle industry.

The Bad

As people geared up for Christmas celebrations in December, cybercriminals also suited up to launch numerous cyberattacks. The past month saw several major data breaches and leaks. Hackers hit Quora, compromising the data of 100 million users. Thousands of sensitive emails of US Republicans was hacked during the US 2018 midterm elections. Oil firm Saipem’s servers in the Middle East were hit by a massive cyberattack. Meanwhile, a misconfigured cloud server exposed taxpayer ID numbers of almost 120 million Brazilians.

  • Hackers hit Quora, compromising the data of 100 million users. Information such as names, email addresses, IP, encrypted passwords, user IDs, and more was accessed by the attackers. The firm is still investigating the matter and is notifying customers about the breach.

  • Thousands of sensitive emails of US Republicans was hacked during the US 2018 midterm elections. The National Republican Congressional Committee (NRCC) reportedly hushed up a major data breach that it sustained earlier this year. The attack saw four senior NRCC aides’ phones surveilled for months by the hackers. Although NRCC alerted the FBI about the breach, senior Republican leaders were unaware about the attack until recently.

  • A slew of massive Hollywood-style bank heists, targeting at least eight European banks, saw hackers steal millions of dollars. The attackers planted devices like a laptop, Raspberry Pi and Bash Bunny inside the targeted banks’ premises, which provided them with remote access to the banks’ networks.

  • Oil firm Saipem’s servers in the Middle East hit by a massive cyberattack. Saipem detected a cyberattack that affected its servers in the Middle East, including the United Arab Emirates, Kuwait, and Saudi Arabia. It’s servers in its main operating centers in Italy, France, and Britain were not affected.

  • Hackers stole login credentials from over 40,000 government authority accounts. The stolen data includes usernames and passwords in plain text. More than half of the stolen accounts (52 percent) belonged to Italian government officials.

  • Misconfigured cloud server exposed taxpayer ID numbers of almost 120 million Brazilians. A misconfigured Apache server containing CPF numbers of nearly 120 million Brazilians were exposed for an unknown period of time. The exposed CPF’s were linked to people’s sensitive information such as names, birth dates, emails, phone numbers, addresses, employment details, and more.

  • Data breach hit Facebook exposing 6.8 million users’ photos. The social networking site has come under fire again for a new API bug leaked private photos of 6.8 million users to third-party apps. The leaked photos were accessible by 1,500 apps built by 876 developers.

  • Twitter suspects state-sponsored threat actors to be behind its recent data breach. The attack targeted one of Twitter’s support forms which the account users use to contact Twitter about the issues they have with their account. Twitter confirmed that the data breach did not expose full phone numbers or any other private data.

  • Nasa suffered a data breach affecting its employees’ personal information. The US National Aeronautics and Space Administration (NASA) disclosed that it has suffered a data breach that may have resulted in the compromise of personal information of both current and former employees.

  • Caribou coffee chain suffered a data breach impacting 239 stores. Cybercriminals gained unauthorized access on to the coffee chain’s point of sale (POS) systems as a result of which customers’ data were exposed.

  • Save the Children Federation lost $1 million to a cyberscam that involved the use of fake invoices. The scammers gained unauthorized access to employees’ email accounts to send fake invoices and other fraudulent documents.

  • The San Diego School District was hit by a data breach compromising the personal data of over 500,000 staffers and students. SDUSD suffered a data breach after cybercriminals launched a targeted phishing attack against a staffer to gain access to login credentials and use it to infiltrate the school district’s networks.

  • BevMo was hit by a massive data breach recently. The cybercriminals gained unauthorized access to the BevMo website and installed a malicious code on the checkout page. The breach impacted nearly 15,000 customers and saw hackers compromise both credit card and personal information of customers.

  • Attackers recently hacked Electrum wallets, stealing over 200 bitcoins worth around $750,000. The attack resulted in the Electrum wallet apps displaying a message on users’ systems that asked them to download a malicious update from an unauthorized Github repository. The attack lasted for seven days and temporarily stopped after Github removed the attacker’s Github repository.

New Threats

December was unfortunately plagued by a swarm of new malware and ransomware attacks. A few new threat actors also emerged over the past month to cause mayhem in cyberspace. 21 new Linux malware strains were discovered. A new Spectre-like CPU attack was uncovered. A new sextortion scam was uncovered that delivers the Azorult data-stealer and the GandCrab ransomware. Magecart’s card skimming tool was up for sale in the Dark Web. A vulnerability in the ThinkPHP framework was exploited by the hacker group D3c3mb3r. Meanwhile, few MacOS malware samples went undetected by most of the antivirus providers.

  • 21 new Linux malware strains were discovered. The new malware families possess sophisticated features like keylogging and backdoor capabilities. Out of the 21 families analyzed, 12 had never been documented.
  • A new Spectre-like CPU attack was uncovered by a six-member security research team, comprising of three academics from Northeastern University and three researchers from IBM Research. The new attack is easier to execute and relies on the same processor design flaws. This attack also increases the speculative execution window length which adds to the attacker’s capabilities.
  • The new Satan ransomware variant Lucky was found exploiting 10 server-side vulnerabilities. Its latest iteration was found exploiting multiple application vulnerabilities affecting both Windows and Linux-based servers.
  • A new sextortion scam delivers the AZORult data-stealer and the GandCrab ransomware. Among the myriad online scams, the so-called “sextortion” scams can be considered one of the scariest kind for victims due to the personal ramifications of such an attack. The scammers in such cases typically blackmail victims, threatening to expose incriminating evidence of illicit activities.
  • OSX.DarthMiner: New malware combines EmPyre backdoor and Monero mining. A new Mac malware dubbed OSX.DarthMiner was recently discovered. combining the EmPyre backdoor and a Monero miner. The malware propagates via the fake version of the Adobe Zii app.
  • The Novidade exploit kit targeted home and office routers, attempting to steal banking information. This attack affected millions of routers, primarily in Brazil, and to a minor extent, the rest of the world. The attackers aimed to steal banking information by redirecting victims to cloned bank web pages.
  • Kremlin-linked cyber espionage group hit government agencies in four continents. The Sofacy hacker group attacked these government agencies with an attempt to infect the agencies with malware. The group used a new malware named Cannon to attack the government entities.
  • A new MacOS malware named LamePyre discovered. This malware tries to appear as a legitimate version of the Discord messenger to trick users. LamePyre is capable of taking screenshots and running a backdoor.
  • Magecart’s card skimming tool was up for sale in the Dark Web for $1300. Magecart’s card skimming tool, which was used to hack British Airways and Ticketmaster, is now available for sale on a dark web forum. The tool consists of two components - a standard universal payment card sniffer and a control panel.
  • PewDiePie supporters hack 50,000 printers to highlight vulnerabilities in the printers. A hacker said that due to the flaws in a printer’s firmware, it was possible to write random data onto to the chip. The vulnerabilities can allow hackers to steal sensitive documents as they get printed.
  • GrandCrab ransomware was spotted using fileless techniques. Fileless ransomware attacks operate by taking default Windows tools, particularly PowerShell and Windows Management Instrumentation (WMI), and using them for malicious activities.
  • Shamoon malware returns with a new variant. Earlier last week, the disk-wiper malware was spotted back in action, with not just one, but two occurrences. The second sighting observed a different strain of the malware and was uploaded to VirusTotal on December 13, 2018, from a user in the Netherlands.
  • One more Mirai IoT botnet variant discovered. Researchers discovered a new Mirai malware variant called Miori which exploits an RCE bug in the ThinkPHP framework. Miori performs a brute force attack via Telnet to infect IoT devices with weak or default authentication to join them to a DDoS botnet.
  • A hacker group named D3c3mb3r has been found exploiting the vulnerability on ThinkPHP framework to gain access to web servers. Another hacker group was also found exploiting the vulnerability to infect servers with the Miori malware.
  • A proof-of-concept that could be used to create a Facebook worm was recently published online. Anyone looking to target users on Facebook could use the worm to spread malware and perform other nefarious activities.
  • Three MacOS Malware samples went undetected by most antivirus providers. Four months after the attack by a mysterious hacker group on Mac users, few of its MacOS malware samples went undetected by most of the antivirus providers. One of these Mac malware variants is believed to have been linked to Windshift the APT group that surveils individuals in the Middle East.
  • New ransomware called JungleSec was spotted exploiting unsecured Intelligent Platform Management Interface (IPMI) cards to infect Windows, Mac, and Linux systems. The ransomware was first reported in early November 2018. However, there is no indication as to how many systems have been affected by the malware.
  • A new sample of Shamoon malware was uploaded recently to the VirusTotal on December 23, 2018. This new variant is signed with a digital signature. It tries to bypass detection by leveraging the digital certificate from the Chinese technology company Baidu. However, the digital signature is no longer valid as it expired on March 26, 2016.

Related Threat Briefings

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.