Cyware Monthly Threat Intelligence

Monthly Threat Briefing • Mar 2, 2021
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • Mar 2, 2021
The Good
A coordinated law enforcement operation successfully shut the shop for ValidCC, a dark web marketplace involved in trading stolen payment card data for more than six years. Meanwhile, the rise in ransomware incidents on healthcare facilities compelled CIS to launch a malicious domain identifier and blocker service. Also, an open-source tool is now available for those who are willing to find unsecured databases.
The Center for Internet Security launched Malicious Domain Blocking and Reporting (MDBR), a no-cost ransomware protection service, available for every healthcare facility through the Multi-State Information Sharing and Analysis Center.
A coordinated law enforcement operation successfully shut the shop for ValidCC, a dark web marketplace involved in trading stolen payment card data for more than six years.
Cyber analysts and researchers from ten organizations, including the Scottish Government and Police Scotland, have joined hands to collaborate and enhance cyber-resilience while educating organizations and individuals on cybersecurity.
The Password Checkup feature was introduced for Android devices, as a part of the Autofill with Google mechanism. This feature will check stored passwords against a database containing records from public data breaches to see if the password was previously leaked.
CyberArk researchers released BlobHunter, an open-source tool organizations can use to discover unsecured Azure blobs containing sensitive files. It audits Azure storage accounts and checks their file access levels.
The Bad
The month touched a new low when state actors attempted to poison a water facility in Florida and risk tens of thousands of lives. Further, the incidents at Accellion and SolarWinds software continue to claim victims while acting as a wake-up call for organizations and government agencies that work with third-parties. Besides, there was a utility scam threatening customers to make immediate payments for fake overdue bills.
Singtel, Bombardier, QIMR Berghofer Medical Research Institute, Washington’s State Auditor office, QIMR Berghofer Medical Research Institute, and Transport for NSW suffered breaches due to vulnerabilities in Accellion’s file-sharing system. While Singtel exposed data of 129,000 customers, the State Auditor office leaked data of 1.6 million employment claims.
A new report from the White House revealed that the SolarWinds hack had breached almost 100 U.S. companies, making them potential targets for follow-up attacks. Moreover, it was disclosed that more than 1,000 hackers rewrote around 4,000 of the millions of lines of code in the SolarWinds Orion update to launch the attack.
Finnish therapy psychotherapy practice firm, Vastaamo, declared bankruptcy after falling victim to a horrific security breach. The problem first began in 2018, when the firm discovered that a database of customer details and notes had been accessed by hackers.
French authorities warned the country’s healthcare sector of the discovery of stolen credentials, apparently belonging to hospital workers. The credentials were put for sale on the dark web.
Texas-based Austin Energy issued a warning about a scam that threatens customers to pay their pending bills. The scammers pretend to be from the company and warn customers that their utilities will be disconnected if they don’t make immediate payment.
Conti ransomware operators published patients’ data stolen from two U.S. hospital chains. The affected organizations are the Florida-based Leon Medical Centers and Nocona-General Hospital in Texas.
The IRS and Security Summit financial industry partners warned against scams aimed at stealing personal information from taxpayers. Adversaries reportedly sent fake emails impersonating IRS Tax E-Filing and asked recipients for their EFIN.
The Cuba ransomware gang launched an attack against the Automatic Funds Transfer Services (AFTS) leading to several data breach notifications from agencies in Washington and California.
A database belonging to Ukraine’s PrivatBank was offered for sale on a popular hacking forum. It contained 40 million records consisting of full names, dates of birth, places of birth, passport details, and phone numbers of customers.
An attacker hacked into a water treatment plant in Oldsmar, Florida, in an attempt to poison the water supply by increasing the level of sodium hydroxide, also known as lye.
The website of the U.K cryptocurrency exchange EXMO was knocked offline following a DDoS attack. This had affected the whole network infrastructure, including the website, API, Websocket API, and exchange charts.
The data of 3.2 million DriveSure clients were available on the Raidforums hacking forum late last month. The information exposed included names, addresses, phone numbers, email addresses, IP addresses, car makers, car service records, dealership records, and car models.
New Threats
The world witnessed threats that were complex, multi-staged, and had capabilities to subdue security controls. In a disclosure, experts revealed that at least four attack groups exploited multiple zero-day in Accellion software. Researchers uncovered two mysterious Mac M1 malware with distinct abilities. Actors hijacked about 500 Windows and Linux devices in one of the largest Monero cyptojacking attacks.