Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Cyber Threat Intelligence

Cyware Monthly Cyber Threat Intelligence February 2019 - Featured Image

Monthly Threat Briefing Mar 1, 2019

The Good

As we gear up to a new month of the year, let’s quickly glance through all that happened over the past month. Before we get into the cybersecurity incidents and the new threats, let’s first acknowledge all the positive events that happened over the past month. Google has released a Chrome extension named ‘Password Checkup’ to protect accounts from data breaches. Google and FIDO Alliance has announced that the Android operating system is now FIDO2 certified. Meanwhile, Sectigo has released Zero-Touch deployment email encryption and digital signing solution to increase compliance with government regulations and reduce cybersecurity risks.

  • Google has released a Chrome extension named ‘Password Checkup’ on the Safer Internet Day (February 5, 2019). This extension checks if usernames and passwords combinations entered in login pages are one of over 4 billion credentials that Google knows to have been previously compromised in data breaches.

  • Google has developed a new Chrome feature that fights against DOM-based XSS attacks. This new feature is a browser API called ‘Trusted Types’ that helps Chrome fight against certain cross-site scripting XSS vulnerabilities. The feature adds another level of protection at the browser level to protect users from cross-site scripting vulnerabilities such as DOM-based XSS.

  • SK Telecom has announced to launch its Quantum Security Gateway solution to prevent hacking in self-driving cars. The solution is an integrated security device that will be installed inside cars and protects various electronic units and networks in the cars. The gateway solution once installed inside cars, monitors various devices for Vehicle-2-Everything (V2X), Bluetooth, radar, smart keys, and driver assistance systems.

  • Google and FIDO Alliance has announced that the Android operating system is now FIDO2 certified which indicates that password authentication could be eradicated from the mobile ecosystem. Now that Android is FIDO2 certified, this enables over a billion Android devices to implement passwordless authentication standards.

  • SSL Certificate Authority Sectigo has released Zero-Touch deployment email encryption and digital signing solution to increase compliance with government regulations and reduce cybersecurity risks. This enables email gateways to scan encrypted traffic in order to detect malware as well as sign an email on behalf of the sender.

  • Google is working to advance the cyber-security model known as ‘confidential computing’ with the Asylo project to protect the integrity of workloads. The confidential computing approach provides an additional layer of protection against malicious insiders, vulnerabilities and compromised operating systems.

  • Mitsubishi Electric has developed a sensor-security technology that detects inconsistencies in sensor measurements when drones, vehicles, or robots are under attack. Mitsubishi plans to commercialize the product next year by offering the technology to manufacturers of cars, drones, etc.

  • Google has made new updates to its Google Play Protect to protect Android users from potentially harmful applications (PHA). Now, Google Play Protect comes as a default built-in feature of every Android device, instead of users manually enabling the feature

The Bad

February witnessed several data breaches and cyber attacks that saw the exposure of millions of people's personal information across the globe. South Africa’s electricity provider Eskom was hit with a double security breach. The Australian Federal Parliament’s computer network has been hacked. In the meantime, Cybercriminals have put up two new databases that contain a total of 69,186 Pakistani banks’ cards for sale on the Joker’s Stash underground forum.

  • South Africa’s primary electricity provider Eskom was hit by not just one, but two security breaches. One was due to an unsecured database that leaked customer data online. The second breach came along with AZORult malware infection disguised as a downloader for The Sims 4 game.

  • The Australian Federal Parliament’s computer network has been hacked. Parliament’s presiding officers, Speaker of the House of Representatives MP Tony Smith and President of the Senate MP Scott Ryan confirmed that there is no evidence that any data has been accessed at this point of time. However, Australian security agencies are suspecting China to be behind this attack.

  • British MPs were targeted by an attempt to access their contacts list and send texts and emails to all their private contacts. Deputy Chief Whip Christopher Pincher warned MPs to be aware of the text messages and emails asking them to provide overseas contact details or to download a secure message app.

  • Almost 620 million account credentials stolen from 16 companies were put up for sale on the Dark Web by a seller named ‘gnosticplayers’. The stolen accounts belonged to 16 websites including Dubsmash, MyFitnessPal, MyHeritage, Animoto, 8fit, 500px, Armor Games, CoffeeMeetsBagel and Artsy. The highest number of account credentials were stolen from Dubsmash, recording a total of 162 million.

  • Followed by the first batch of 620 million accounts stolen from 16 companies, a second batch containing 127 million stolen accounts was made available for sale on the Dark Web by ‘gnosticplayers’ who quoted $14,500 in bitcoin for the collection. The stolen accounts belonged to 8 companies including Ixigo, Houzz, YouNow, Coinmama, Petflow, Ge.tt, Roll20.net, and StrongHoldKingdoms.

  • The seller ‘gnosticplayers’ was back again with a collection of 93 million stolen account credentials from 8 companies. This is the third batch made available for sale by gnosticplayers in the Dream Market marketplace which is worth 2.6249 bitcoin amounting to $9,400.

  • Attackers compromised North Country Business Products (NCBP) IT systems and planted malware on its clients’ Point-of-Sale (POS) systems. The attack has impacted nearly 140 food chains such as coffee shops, restaurants, bars, standalone hotels, and various food chain franchises. The impacted food chains included Dunn Brothers Coffee, Someburros, Zipps Sports Grill, and more.

  • A storage server containing real-time call recordings made to the 1177 Swedish Healthcare Guide helpline for health care information was found publicly available without any password protection. The unprotected server which was left open without a password exposed almost 2.7 million health-related call recordings that dated back to 2013.

  • Researchers observed a new Ad fraud campaign dubbed ‘DrainerBot’ which plays invisible ad videos in Android devices via infected apps. The DrainerBot ad fraud scheme uses malicious codes in Android apps to deliver ad videos to mobile devices that have installed the infected apps. The ad fraud scheme has been distributed via infected Android applications that have almost 10 million downloads.

  • A new phishing attack dubbed ‘NoRelationship’ was observed recently that bypasses Microsoft’s Exchange Online Protection (EOP) URL filters which scans Microsoft Office documents such as Word (.docx), Excel (.xlsx), and PowerPoint (.pptx). The attackers behind the ‘NoRelationship’ phishing campaign deleted external links from a relationship (xml.rels) file which is a legitimate file that lists all links included in an attachment. This lead to Microsoft’s Exchange Online Protection filters not detecting the malicious URL.

  • Dow Jones Watchlist’s database was publicly available without any password protection thereby exposing almost 2.4 million records. Upon learning the incident, Dow Jones immediately disabled the leaky Elasticsearch database.

  • Cybercriminals have put up two new databases that contain a total of 69,186 Pakistani banks’ cards for sale on the Joker’s Stash underground forum which is estimated to be approximately $3.5 million. Researchers noted that the price of a single card detail ranged between $10 and $40, and the cards with PIN codes were priced at $50.

New Threats

Several new malware, ransomware, vulnerabilities, and threat groups emerged over the past month. Researchers spotted a new backdoor trojan dubbed ‘Speakup’ that infects Linux and MacOS systems. A Monero cryptocurrency-mining malware variant has been found using a combination of RADMIN and MIMIKATZ exploit tools to spread across networks. Last but not least, New vulnerabilities dubbed ‘Zombie POODLE’ and ‘GOLDENDOODLE’ were spotted affecting the HTTPS.

  • A new malware campaign distributing the Orcus Remote Access Trojan (RAT) has been discovered recently. A threat actor group named PUSIKURAC is found to be behind this campaign. The campaign distributed the Orcus RAT by injecting the malware in a Ramadan-themed Coca-Cola video.
  • Researchers observed a Geodo spam campaign targeting employees of a US government agency. This campaign was spotted dropping the Qakbot malware onto unsuspecting systems. The phishing campaign delivered a malicious Office document containing hostile macros. Once the macro is executed, it downloads a PowerShell-based Qakbot payload.
  • New vulnerabilities dubbed ‘Zombie POODLE’ and ‘GOLDENDOODLE’ were spotted affecting the HTTPS. Researchers noted that these vulnerabilities arise from the continued use of cryptographic modes which should already have been deprecated.
  • A quickly evolving botnet called Cayosin has been observed recently by researchers. The botnet has a unique property of combining the most dangerous features of multiple previous botnets and makes them available to a broad audience at a reasonable price. The botnet is actually a custom piece of malware with characteristics similar to QBot, Mirai and a few other pieces of software.
  • A security vulnerability in Ubiquiti Networks impacted nearly 485,000 devices. Jim Troutman, Consultant, and Director of NNENIX, disclosed on Twitter that attackers are remotely exploiting Ubiquity networking devices exposed via a UDP port 10001. A majority of the exposed Ubiquity devices are NanoStation (172,000), AirGrid (131,000), LiteBeam (43,000), PowerBeam (40,000), and NanoBeam (21,000) products.
  • The Outlaw threat actor group was spotted conducting a malware campaign targeting Linux systems in cryptocurrency mining attacks. The campaign used a new version of Shellbot trojan which bridges a tunnel between an infected system and a C&C server operated by the attackers.
  • Researchers spotted a new malware campaign distributing a backdoor trojan named ‘SpeakUp’ which exploits known vulnerabilities in six different Linux software. This malware campaign targets servers in East Asia and Latin America, including AWS hosted machines. Researchers noted that this campaign also manages to evade all antivirus solutions.
  • A team of academics has found a new variant of the infamous Bleichenbacher's attack affecting the latest version of the TLS protocol, TLS1.3. The new variant of Bleichenbacher's attack could allow attackers to intercept the TLS traffic and steal data. The new variant of Bleichenbacher's attack also affects Google’s new QUIC encryption protocol.
  • A security researcher recently discovered a vulnerability affecting the Ubuntu operating system. The researcher named the vulnerability as ‘Dirty Sock’ and noted that this bug is a local privilege escalation vulnerability which could allow attackers to gain root level access to the system.
  • A new variant of Emotet trojan has been observed in the wild. This new variant obfuscates the initial infection VBA macro code to avoid detection by anti-virus software. Researchers noted that the new variant is delivered in two different ways: First, via a URL that is hosted on attacker-controlled infrastructure and second, as an email attachment.
  • A Monero cryptocurrency-mining malware variant has been found using a combination of RADMIN and MIMIKATZ exploit tools to spread across the local area networks. The attack campaign primarily targets companies in China, Taiwan, Italy, and Hong Kong.
  • Researchers from Avast detected a new malware strain dubbed Rietspoof, which is distributed via instant messaging clients such as Facebook Messenger and Skype. Rietspoof is a multi-stage malware that utilizes several stages to drop a more versatile malware. The actual Rietspoof malware is dropped in the third stage with capabilities such as downloading or uploading files, starting processes, or initiating a self-destruct function.
  • A new malware dubbed Muncy has been spotted targeting victims worldwide. Muncy malware is distributed via a phishing campaign that impersonates the logistics giant DHL to trick users. Apart from spoofing the emails, the attackers behind Muncy are also leveraging poorly configured SMTP servers to distribute the malware.
  • Researchers uncovered a new ATM malware dubbed WinPot that uses a slot machine interface to steal funds by compromising ATMs. WinPot, also known as ATMPot, is designed to compromise the ATMs and force these machines to empty their cassettes of all funds. A seller of the malware has recently offered WinPot v.3 which includes a revamped interface and a currently unidentified program called ‘ShowMeMoney’.
  • Researchers uncovered new ransomware dubbed B0r0nt0K that encrypts victim's websites and demands a ransom payment of 20 bitcoin, which is worth $75,000. Researchers noted that B0r0nt0K ransomware currently infects Linux servers, but may also have the ability to encrypt Windows OS.
  • A new vulnerability dubbed ‘Thunderclap’ was detected in the Thunderbolt hardware interface. This ‘Thunderclap’ vulnerability impacts Windows, Mac, Linux, and FreeBSD systems.
  • Researchers identified a new malware dubbed Farseer that frequently-targets the Microsoft Windows operating system. Farseer has connections to other malware, such as HenBox, Poison Ivy, Zupdax, and PKPLUG. The malware leverages a technique known as ‘DLL sideloading’ to drop legitimate, signed binaries to the host.
  • A new vulnerability dubbed ‘Cloudborne’ has been detected recently. This vulnerability could allow attackers to implant backdoor in the firmware or BMC of bare metal servers causing a variety of attack situations such as performing a PDoS attack, stealing data from the application running on the cloud service, and executing a ransomware attack by disabling the application.
  • A research team from Greece outlined a new browser-based attack dubbed ‘MarioNet’ that could allow attackers to run malicious code inside users’ browsers even after the web page is closed. MarioNet attack enables attackers to assemble giant botnets from users’ browsers and later use them to conduct various malicious activities.
  • Researchers observed a spear phishing campaign containing a new malware dubbed ‘BabyShark’. The spear-phishing campaign targets national security think tanks and research institutions in the US. BabyShark malware shares similarities with the KimJongRaT.

Related Threat Briefings

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.