Cyware Monthly Threat Intelligence

Monthly Threat Briefing • May 13, 2020
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • May 13, 2020
Considering the exigency around COVID-19 themed cyberattacks, various industry leaders have stepped up to ensure enhanced and collaborative security practices. Last month, Microsoft released new security guidelines to safeguard against attacks on employees working from home during the pandemic. Also, the US Office for Civil Rights (OCR) dropped HIPAA penalties for community-based testing sites to assuage the operations of healthcare providers. Meanwhile, the two tech giants, Microsoft and Google, updated their respective cloud computing services to improve the security of data processing.
Microsoft published new threat intel and security guidance for individuals and organizations in the wake of rising incidents of phishing and social engineering attacks that have hit every country during the coronavirus pandemic.
The Office for Civil Rights (OCR) announced to lift penalties around HIPAA compliance for 19 community-based testing sites during the pandemic. Previously, the agency had also carved out exceptions for business associates, first responders, and telehealth use to ease operations during the COVID-19 pandemic.
Google has adapted its machine learning models to improve Gmail’s security against COVID-19-themed phishing email attacks. Using these models, Gmail malware scanners have blocked around 18 million phishing and malware emails, and more than 240 million spam messages (using COVID-19 baits), within seven days.
Microsoft and Google announced updates for their respective virtual machine (VM) instances storing highly confidential information processed in Microsoft Azure and Google Compute Engine cloud platforms.
While the lockdown keeps everyone worried, hackers continue to upgrade capabilities of malicious exploits while enhancing their attack techniques. A security researcher reported multiple online firms blurting out email data of their customers to third-party advertising and analytics companies. In other news, hackers put 530,000 Zoom login credentials for sale on an underground marketplace. Also, Travelex paid $2.3 million ransom in bitcoin to get hold of their stolen data.
A researcher reported multiple popular websites exposing millions of user email addresses to advertising and analytics companies. The websites included Quibi.com, JetBlue.com, KongHQ.com, NGPVan.com, Mailchimp’s Mandrill.com, WashingtonPost.com, and Wish.com.
Hackers put 530,000 Zoom login credentials for sale on hacker forums for a price of $0.0020 per account. The hacker(s) had gathered these account details from third-party data breaches rather than hacking Zoom directly.
Le Figaro, a popular French daily newspaper, exposed 7.4 billion records due to a misconfigured Elasticsearch database. The exposed PII data included full names, emails, home addresses, countries of residence, postcodes, IP addresses, server access tokens, and passwords for new users.
Unknown activists posted nearly 25,000 email addresses and passwords belonging to the National Institutes of Health (NIH), World Health Organization (WHO), Gates Foundation, and other groups working to combat the coronavirus pandemic. The lists were posted on 4chan, Pastebin, Twitter, and Telegram.
An unsecured database owned by the email delivery and marketing firm, Maropost, leaked about 95 million email records and email logs in a data breach. The leaked email logs contained relevant metadata, such as the exact date and time when the emails were sent. The database, which was hosted on a Google cloud server, was taken offline on April 1, 2020.
Cybercriminals breached the database of the Aptoide app store to steal 39 million user records. Out of these, 20 million user details, including login emails and hashed passwords, were published on a popular hacker forum.
Nearly 9 million travel logs belonging to British citizens were exposed due to a glitch in Sheffield City Council’s automatic number-plate recognition (ANPR) system. The exposed records included number plates and travel logs going through Sheffield’s road network. In a different incident, GDPR.EU had also leaked Git data and passwords due to a flaw in the website.
The US Small Business Administration (SBA) revealed that the personally identifiable information (PII) for some of the financial relief loan applicants may have been exposed to other applicants online. The incident occurred due to a security flaw in the loan application site. The issue was immediately resolved and the application portal was relaunched to avoid exposure of sensitive data.
Personal and contact details of 1.41 million US-based doctors stolen from qa.findadoctor[.]com were also put up for sale by a cybercriminal. The compromised data included full names, genders, locations, mailing addresses, country, phone numbers, and license numbers of doctors.
Travelex disclosed that it paid a ransom of $2.3 million in bitcoin to the Sodinokibi group to get back their stolen data and restore operations. The attack had taken place during the New Year’s eve of 2020. The Sodinokibi ransomware operators had stolen nearly 5 GB of data from the firm during the attack.
Among new threats, FPGA chips were found to be affected by two flaws that could expose several critical systems to attack. Also, researchers discovered several new malware like EventBot, LeetHozer botnet, Asnarök trojan, and more, last month. Additionally, the Trickbot trojan made a comeback, leveraging the Family and Medical Leave Act (FMLA) to create lures related to COVID-19.