The Good

September has come and gone. As yet another month comes to an end, it's time to recap about some of the largest breaches, attacks, and the newest technologies to have cropped up over the past month. However, it's also time to celebrate all the positive strides that global organizations have taken to mitigate threats and improve security. The US Justice Department charged a North Korean hacker over the Sony and the WannaCry attacks.The hacker behind the JPMorgan cyberattack was nabbed by US feds.The US Air Force is working on establishing a new rapid cyber response center. Meanwhile, on the R&D side researchers developed a way to store cryptocurrency passwords in DNA. On the other hand, a new generation of cyber warriors may soon be ready to combot attacks. Fujitsu announced its partnership with University Technical Colleges (UTCs) to help teenagers prepare for a career in cybersecurity.

• Google is rolling out a verification program to weed out tech support scammers and ensure only legitimate third-party tech support providers use its ad network to reach consumers. The move comes after the Wall Street Journal reported scammers have been buying Google ads and posing as authorized service agents for Apple.
• The latest version of Google’s Chrome browser, version 69, was also released this week and comes with a brand new redesign and an improved password manager. Chrome will offer to automatically generate a random password whenever you sign up to a website for the first time that will be securely stored inside a Google Account. The feature is designed to stop people from using the same password across multiple websites.
• The National Institute of Standards and Technology (NIST) announced plans to create a voluntary privacy framework to help organizations manage risk and protect consumer privacy. The framework will go beyond basic cybersecurity practices and focus on privacy risks that arise from how organizations collect, store, use and share consumer data, the agency said.
• The US Department of Justice announced charges against North Korean programmer Park Jin Hyok over the 2014 Sony hack, the 2016 Bangladesh Bank cyber heist and last year’s WannaCry ransomware attack. Park is linked to the North Korean APT Lazarus Group and has been accused of working with the North Korean government to carry out the attacks. He has been charged with several crimes including hacking charges, conspiracy and conspiracy to commit wire fraud.
• Russian citizen Andrei Tyurin was extradited from the nation of Georgia to face charges in the US over the massive JPMorgan Chase hack in 2014. The suspect was a major player in several cyber attacks against multiple finance-related firms including Dow Jones & Co., E*Trade Financial Corp, Scottrade Financial Services and Fidelity Investments. The JPMorgan Chase hack alone saw the compromise of about 76 million customers.
• Russian national Peter Yuryevich Levashov pleaded guilty to operating the Kelihos botnet to facilitate a global spam and credential-stealing operation. The 38-year-old programmer - dubbed one of the world’s most notorious criminal spammers - had operated multiple botnets since the 1990s such as Storm and Waledac.
• On the other side of the pond, British police arrested hacker George Duke-Cohan who pleaded guilty to three counts of making hoax bomb threats. The 19-year-old was the leader of the hacking collective “Apophis Squad” that launched DDoS attacks against ProtonMail, Tutanota and other sites over the summer.
• On the research side, a group of asset managers and biotechnologists have created a cold storage data vault named Carverr that can store cryptocurrency passwords in synthetic DNA. The cryptocurrency password can be stored inside a drop of liquid in a micro tube of DNA that contains about a quadrillion copies of a digital wallet.
• The US Air Force is working on establishing a new rapid cyber response center that will be modeled after the Air Force’s Rapid Capibilities Office. The goal for the new center would be “to tackle the cyber challenges from a rapid capabilities standpoint and a cyber standpoint,” Maj. Gen. Robert Skinner, commander of 24th Air Force/Air Forces Cyber, said during a panel at the annual Air, Space and Cyber conference.
• The Chinese police arrested the hacker responsible for selling the data of millions of customers of the Huazhu hotel chain on the dark web. The hacker attempted to blackmail the hotel chain into paying a ransom for the recovery of its data. However, Huazhu said that the cybercriminal was unsuccessful in his attempt to sell any of the compromised data.
• The US army is looking to boost its cyber teams’ resource and abilities. The army’s expeditionary cyber support detachments (ECSDs) are small units connected to organizations that provide cyber and electromagnetic spectrum effects such as sensing or jamming.
• Fujitsu announced its partnership with University Technical Colleges (UTCs) to help teenagers prepare for a career in cybersecurity. The soon-to-be-launched UTC Cyber Security Group is aimed at helping 500 hundred cybersecurity students every year aged 14 to 19 years. The new organization aims to bridge the gap in security resource and skills currently impacting the industry.
• More organizations are using blockchain to combat cyberattacks. For instance, the government of Estonia recently adopted a blockchain system to ensure that citizens’ healthcare data is protected.
• VirusTotal received a major upgrade that includes an advanced malware search a 100 times faster than before. The platform now comes with three new features - Private Graph, Advanced Malware Search and Enterprise User Management. The new features are aimed at boosting an organization's ability to detect and mitigate threats.

The Bad

September saw a wave of destructive attacks, breaches and data leaks that impacted thousands of individuals across the globe. British Airways suffered a major data breach. Spyware firms Family Orbit and mSpy leaked hundreds of thousands of customers’ data online.Data firm Veeam exposed over 200GB of customer records. GovPayNet accidentally exposed 14 million customer records dating back to 2012. Meanwhile, the cryptocurrency exchange Zaif was hacked and $60 million was stolen by hackers. Meanwhile, the Port of Barcelona was hit by an attack that took down its servers and the online shopping firm SHEIN was hit by hackers who 6.42 million users emails and encrypted passwords.

• British Airways revealed this week that was hacked, compromising hundreds of thousands of customers’ personal and financial details. The airline said the hack continued for nearly two weeks between August 21 and September 5, compromising 380,000 payment cards.
• Spyware app provider Family Orbit exposed a whopping 281GB worth of customers’ data online including pictures of hundreds of monitored children. A hacker discovered the data was stored on unsecured cloud servers that had simple, easy-to-crack password protection. Motherboard verified the breach with Family Orbit who then changed their API key and login credentials.
• Data management firm Veeam accidentally exposed a database containing more than 200GB of customer records, including names, email addresses and IP addresses. Security researcher Bob Diachenko discovered the database online that did not have a password. It contained two collections of 199.1 million email addresses and 244.4 million records aggregated over a four-year period between 2013 and 2017.
• Dozens of popular iPhone apps have been quietly sharing the location data of “tens of millions of mobile devices” with third-party data monetization firms, security researchers at the GuardianApp project discovered. Data collected by these apps included Bluetooth beacons, Wi-Fi network names, accelerometer data, battery charge status and cell network names. Some of the offending apps included ASKfm, Perfect365, Homes.com and more.
• Popular delivery service platform Freshmenu failed to disclose a massive data breach in 2016 that affected over 100,000 users. The security incident was revealed by security expert Troy Hunt’s HaveIBeenPwned service. Data compromised included names, addresses and detailed order histories.
• Edinburgh University was hit by a cyberattack this week that crippled its computer systems for hours. UK non-profit Jisc said a “number of universities” were targeted this week noting that DDoS attacks typically increases around the time new students are enrolling for courses or returning to university. A university spokesman said no data was compromised in the attack.
• The US State Department’s unsecured email system was compromised by cybercriminals. The breach impacted around 1 percent of employees, whose personal details were believed to have been accessed by the attackers.
• GovPayNet accidentally exposed 14 million customer records dating back to 2012. The service’s website, which is used by multiple U.S state and local governments, contained a vulnerability that allowed attackers to view customer records just by altering the digits in the web address. These digits are available on every receipt generated as a payment acknowledgment for customers.
• Japanese cryptocurrency Zaif was hit by hackers who stole over $60 million worth of Bitcoin, Bitcoin Cash and Monacoin. The hackers gained unauthorized access to the server managing hot wallets to steal the funds. The firm has planned to secure a $44.5 million loan to pay back the customers affected by the hack.
• NewsNow suffered a data breach that compromised users’ encrypted passwords. NewsNow has yet to determine the number of user account passwords compromised by the breach. However, the news aggregator claimed that no financial data was impacted by the breach.
• The Port of Barcelona was hit by a cyberattack that took down its servers and IT systems. It is still unclear as to whether the organization suffered a malware, DDoS or some other kind of attack. The identity of the attacker(s) behind the attack is also currently unknown. However, maritime and land operations were unaffected by the attack.
• The online shopping firm SHEIN was hit by hackers who 6.42 million users emails and encrypted passwords. Although the firm discovered the breach earlier this month, it is believed that the attack may have begun in June. The firm said that the attackers carried out a well-planned strategy to infiltrate the security protections of their computers.

New Threats

We also saw numerous new malware, botnets and vulnerabilities emerge, targeting victims globally. A new threat actor named Rocke uses Git repositories to distribute a Monero miner. Chinese-speaking LuckyMouse is using malicious NDISProxy drivers to distribute Trojans. New Mirai and Gafgyt botnet variants are targeting multiple exploits.Meanwhile, the XBash malware comes with ransomware, cryptomining, botnet and worm capabilities. The new Russian botnet Black Rose Lucy allows cybercriminals to target Android devices. The new Torii IoT botnet was just discovered and is considered to be the “most sophisticated botnet” to have ever emerged. A new Android spyware was found with the ability to steal WhatsApp data, contacts, photos and more. Meanwhile, the newly discovered FragmentSmack flaw impacts around 88 Cisco products.

• Cisco Talos researchers discovered a Chinese-language threat actor named Rocke that has been using a mixed bag of tools and Git repositories to infect systems with a Monero-mining malware. The attacker has also exploiting several flaws to deploy to malware including Apache Struts flaws, an Oracle WebLogic server vulnerability and a critical Adobe ColdFusion bug.
• A new banking Trojan dubbed CamuBot has been spotted targeting Brazilian banking customers. IBM X-Force researchers said the malware camouflages itself as a security module required by the banks it targets. The unique malicious code is also capable of hijacking one-time passwords used for biometric authentication as well.
• Iran-linked APT Domestic Kitten has been quietly spying on Iranian and Kurdish citizens as well as ISIS supporters since 2016 using malicious, data-stealing mobile apps. Three malicious apps used by the group included a wallpaper changer, an app purporting to offer news updates from Kurdish news website ANF and a fake version of Vidogram. Data collected from compromised phones included contact lists, text messages, geolocation, photos and more.
• Chinese-speaking APT LuckyMouse is using malicious NDISProxy Windows drivers and stolen digital certificates to distribute Trojans. The seemingly legitimate security certificates actually belong to Chinese security software developer LeagSoft and are believed to be stolen. The exploited driver tool is used to infect lsass.exe system process memory.
• New variants of the notorious Mirai and Gafgyt botnets are using multiple vulnerabilities to compromise IoT devices. One of the flaws is the CVE-2017-5638 Apache Struts vulnerability that was exploited in the Equifax breach. A recently-disclosed flaw in SonicWall's Global Management System is also being exploited.
• XBash is a newly discovered malware that contains ransomware, cryptomining, botnet and worm capabilities. The malware was developed and is being used by the cybercriminal gang called Iron Group (aka Rocke) and has already raked in over $6,000.
• Black Rose Lucy is a new Russian botnet, developed by the Russian cybercrime group - The Lucy Group. The botnet cropped up in the malware-as-a-service (MaaS) arena and can allow cybercriminals to target Android OS devices. The botnet has been targeting victims in Russia, France, Israel and Turkey.
• The newly discovered Peekaboo flaw can allow attackers the ability to view and tamper with video and security camera feeds. The zero-day vulnerability affects security cameras and surveillance equipment that use the NUUO software. The bug can also allow attackers to steal data including credentials, IP addresses, port usages, and device model numbers.
• The new Torii IoT botnet was just discovered and is considered to be the “most sophisticated botnet” to have ever emerged. The malware author(s) appears to have designed Torii to be stealthy and persistent. In comparison with other IoT botnet such as VPNFilter and Hide and Seek, which focus on high persistence attacks, security researchers believe that Torii supports one of the largest sets of architectures they’ve seen so far.
• A new Android spyware was found with the ability to steal WhatsApp data, contacts, photos and more. The malware comes packed with numerous surveillance features and its code is currently publicly available. The malware is also capable of activating an infected device’s camera to take photos, record calls and take screenshots.
• The newly discovered FragmentSmack flaw impacts around 88 Cisco products. FragementSmack can allow attackers to create a DoS condition on affected devices. Although FragmentSmack was originally discovered on Linux, the flaw, when combined with its sibling SegmentSmack, can also impact Windows systems.