Cyware Monthly Cyber Threat Intelligence

Monthly Threat Briefing • Sep 29, 2018
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • Sep 29, 2018
September has come and gone. As yet another month comes to an end, it's time to recap about some of the largest breaches, attacks, and the newest technologies to have cropped up over the past month. However, it's also time to celebrate all the positive strides that global organizations have taken to mitigate threats and improve security. The US Justice Department charged a North Korean hacker over the Sony and the WannaCry attacks.The hacker behind the JPMorgan cyberattack was nabbed by US feds.The US Air Force is working on establishing a new rapid cyber response center. Meanwhile, on the R&D side researchers developed a way to store cryptocurrency passwords in DNA. On the other hand, a new generation of cyber warriors may soon be ready to combot attacks. Fujitsu announced its partnership with University Technical Colleges (UTCs) to help teenagers prepare for a career in cybersecurity.
Google is rolling out a verification program to weed out tech support scammers and ensure only legitimate third-party tech support providers use its ad network to reach consumers. The move comes after the Wall Street Journal reported scammers have been buying Google ads and posing as authorized service agents for Apple.
The latest version of Google’s Chrome browser, version 69, was also released this week and comes with a brand new redesign and an improved password manager. Chrome will offer to automatically generate a random password whenever you sign up to a website for the first time that will be securely stored inside a Google Account. The feature is designed to stop people from using the same password across multiple websites.
The National Institute of Standards and Technology (NIST) announced plans to create a voluntary privacy framework to help organizations manage risk and protect consumer privacy. The framework will go beyond basic cybersecurity practices and focus on privacy risks that arise from how organizations collect, store, use and share consumer data, the agency said.
The US Department of Justice announced charges against North Korean programmer Park Jin Hyok over the 2014 Sony hack, the 2016 Bangladesh Bank cyber heist and last year’s WannaCry ransomware attack. Park is linked to the North Korean APT Lazarus Group and has been accused of working with the North Korean government to carry out the attacks. He has been charged with several crimes including hacking charges, conspiracy and conspiracy to commit wire fraud.
Russian citizen Andrei Tyurin was extradited from the nation of Georgia to face charges in the US over the massive JPMorgan Chase hack in 2014. The suspect was a major player in several cyber attacks against multiple finance-related firms including Dow Jones & Co., E*Trade Financial Corp, Scottrade Financial Services and Fidelity Investments. The JPMorgan Chase hack alone saw the compromise of about 76 million customers.
Russian national Peter Yuryevich Levashov pleaded guilty to operating the Kelihos botnet to facilitate a global spam and credential-stealing operation. The 38-year-old programmer - dubbed one of the world’s most notorious criminal spammers - had operated multiple botnets since the 1990s such as Storm and Waledac.
On the other side of the pond, British police arrested hacker George Duke-Cohan who pleaded guilty to three counts of making hoax bomb threats. The 19-year-old was the leader of the hacking collective “Apophis Squad” that launched DDoS attacks against ProtonMail, Tutanota and other sites over the summer.
On the research side, a group of asset managers and biotechnologists have created a cold storage data vault named Carverr that can store cryptocurrency passwords in synthetic DNA. The cryptocurrency password can be stored inside a drop of liquid in a micro tube of DNA that contains about a quadrillion copies of a digital wallet.
The US Air Force is working on establishing a new rapid cyber response center that will be modeled after the Air Force’s Rapid Capibilities Office. The goal for the new center would be “to tackle the cyber challenges from a rapid capabilities standpoint and a cyber standpoint,” Maj. Gen. Robert Skinner, commander of 24th Air Force/Air Forces Cyber, said during a panel at the annual Air, Space and Cyber conference.
The Chinese police arrested the hacker responsible for selling the data of millions of customers of the Huazhu hotel chain on the dark web. The hacker attempted to blackmail the hotel chain into paying a ransom for the recovery of its data. However, Huazhu said that the cybercriminal was unsuccessful in his attempt to sell any of the compromised data.
The US army is looking to boost its cyber teams’ resource and abilities. The army’s expeditionary cyber support detachments (ECSDs) are small units connected to organizations that provide cyber and electromagnetic spectrum effects such as sensing or jamming.
Fujitsu announced its partnership with University Technical Colleges (UTCs) to help teenagers prepare for a career in cybersecurity. The soon-to-be-launched UTC Cyber Security Group is aimed at helping 500 hundred cybersecurity students every year aged 14 to 19 years. The new organization aims to bridge the gap in security resource and skills currently impacting the industry.
More organizations are using blockchain to combat cyberattacks. For instance, the government of Estonia recently adopted a blockchain system to ensure that citizens’ healthcare data is protected.
VirusTotal received a major upgrade that includes an advanced malware search a 100 times faster than before. The platform now comes with three new features - Private Graph, Advanced Malware Search and Enterprise User Management. The new features are aimed at boosting an organization's ability to detect and mitigate threats.
September saw a wave of destructive attacks, breaches and data leaks that impacted thousands of individuals across the globe. British Airways suffered a major data breach. Spyware firms Family Orbit and mSpy leaked hundreds of thousands of customers’ data online.Data firm Veeam exposed over 200GB of customer records. GovPayNet accidentally exposed 14 million customer records dating back to 2012. Meanwhile, the cryptocurrency exchange Zaif was hacked and $60 million was stolen by hackers. Meanwhile, the Port of Barcelona was hit by an attack that took down its servers and the online shopping firm SHEIN was hit by hackers who 6.42 million users emails and encrypted passwords.
British Airways revealed this week that was hacked, compromising hundreds of thousands of customers’ personal and financial details. The airline said the hack continued for nearly two weeks between August 21 and September 5, compromising 380,000 payment cards.
Spyware app provider Family Orbit exposed a whopping 281GB worth of customers’ data online including pictures of hundreds of monitored children. A hacker discovered the data was stored on unsecured cloud servers that had simple, easy-to-crack password protection. Motherboard verified the breach with Family Orbit who then changed their API key and login credentials.
Data management firm Veeam accidentally exposed a database containing more than 200GB of customer records, including names, email addresses and IP addresses. Security researcher Bob Diachenko discovered the database online that did not have a password. It contained two collections of 199.1 million email addresses and 244.4 million records aggregated over a four-year period between 2013 and 2017.
Dozens of popular iPhone apps have been quietly sharing the location data of “tens of millions of mobile devices” with third-party data monetization firms, security researchers at the GuardianApp project discovered. Data collected by these apps included Bluetooth beacons, Wi-Fi network names, accelerometer data, battery charge status and cell network names. Some of the offending apps included ASKfm, Perfect365, Homes.com and more.
Popular delivery service platform Freshmenu failed to disclose a massive data breach in 2016 that affected over 100,000 users. The security incident was revealed by security expert Troy Hunt’s HaveIBeenPwned service. Data compromised included names, addresses and detailed order histories.
Edinburgh University was hit by a cyberattack this week that crippled its computer systems for hours. UK non-profit Jisc said a “number of universities” were targeted this week noting that DDoS attacks typically increases around the time new students are enrolling for courses or returning to university. A university spokesman said no data was compromised in the attack.
The US State Department’s unsecured email system was compromised by cybercriminals. The breach impacted around 1 percent of employees, whose personal details were believed to have been accessed by the attackers.
GovPayNet accidentally exposed 14 million customer records dating back to 2012. The service’s website, which is used by multiple U.S state and local governments, contained a vulnerability that allowed attackers to view customer records just by altering the digits in the web address. These digits are available on every receipt generated as a payment acknowledgment for customers.
Japanese cryptocurrency Zaif was hit by hackers who stole over $60 million worth of Bitcoin, Bitcoin Cash and Monacoin. The hackers gained unauthorized access to the server managing hot wallets to steal the funds. The firm has planned to secure a $44.5 million loan to pay back the customers affected by the hack.
NewsNow suffered a data breach that compromised users’ encrypted passwords. NewsNow has yet to determine the number of user account passwords compromised by the breach. However, the news aggregator claimed that no financial data was impacted by the breach.
The Port of Barcelona was hit by a cyberattack that took down its servers and IT systems. It is still unclear as to whether the organization suffered a malware, DDoS or some other kind of attack. The identity of the attacker(s) behind the attack is also currently unknown. However, maritime and land operations were unaffected by the attack.
The online shopping firm SHEIN was hit by hackers who 6.42 million users emails and encrypted passwords. Although the firm discovered the breach earlier this month, it is believed that the attack may have begun in June. The firm said that the attackers carried out a well-planned strategy to infiltrate the security protections of their computers.
We also saw numerous new malware, botnets and vulnerabilities emerge, targeting victims globally. A new threat actor named Rocke uses Git repositories to distribute a Monero miner. Chinese-speaking LuckyMouse is using malicious NDISProxy drivers to distribute Trojans. New Mirai and Gafgyt botnet variants are targeting multiple exploits.Meanwhile, the XBash malware comes with ransomware, cryptomining, botnet and worm capabilities. The new Russian botnet Black Rose Lucy allows cybercriminals to target Android devices. The new Torii IoT botnet was just discovered and is considered to be the “most sophisticated botnet” to have ever emerged. A new Android spyware was found with the ability to steal WhatsApp data, contacts, photos and more. Meanwhile, the newly discovered FragmentSmack flaw impacts around 88 Cisco products.