Cyware Monthly Threat Intelligence
Monthly Threat Briefing • February 3, 2020
The Good
Slump back in your favorite chair as we go over all the cybersecurity incidents for the first month of the year 2020. To begin with, let’s learn about all the good developments first. Researchers from Ben-Gurion University introduced first-ever all-optical ‘stealth’ encryption technology. In other news, MITRE released its new ATT&CK framework for Industrial Control Systems (ICS). Also, the National Institute of Standards and Technology (NIST) launched version 1.0 of its Privacy Framework to help businesses manage data privacy issues.
- BGN Technologies, a subsidiary of Ben-Gurion University, introduced first-ever all-optical ‘stealth’ encryption technology that will strengthen the security and privacy of highly sensitive cloud-computing and data center network transmission. This technology is an extension of the digital optical encryption method originally invented at Bar Ilan University.
- MITRE released a new ATT&CK knowledge-base of the tactics and techniques that cybercriminals use while attacking Industrial Control Systems (ICS). The framework highlights the unique aspects of the specialized applications and protocols that system operators typically use, and which adversaries can take advantage of.
- The National Institute of Standards and Technology (NIST) released version 1.0 of its Privacy Framework to help improve organizations’ approach to using and protecting personal data. The voluntary tool can not only assist organizations in managing privacy risk arising from their products and services but also demonstrate compliance with laws that may affect them.
- The Department of Homeland Security and the General Services Administration proposed a centralized vulnerability disclosure platform that could serve as a primary point of entry for security researchers analyzing flaws in government systems. The platform is likely to be managed by CISA, while other agencies might have to kick in some of their own funding.
The Bad
There were also numerous cases of breaches this month that caused potential harm to millions of individuals. Cybercriminals posted payment card details of more than 30 million Americans and over one million foreigners for sale on Joker's Stash, traces of which were linked with the Wawa Inc. database breach. Also, the stolen data from Toronto-based firm Bird Construction was published by ransomware attackers after it denied their demands. Meanwhile, researchers reported Microsoft’s unsecured Elasticsearch servers exposing call center data of almost 250 million customers.
- Cybercriminals reportedly uploaded payment card details of more than 30 million Americans and over one million foreigners for sale on the Joker's Stash forum. The experts have traced the card data back to Wawa Inc breach from December 2019. According to Wawa, the malware operated without being detected for months, between March 4 and December 12, 2019.
- Bird Construction, a Toronto-based construction company, suffered a ransomware attack likely by the Maze operators. The attackers claimed to have stolen 60 GB of data including 48 contract deals worth $406 million. Now, the Maze actors have published troves of data it claims to have stolen from Bird Construction.
- Researched noted that Microsoft had briefly exposed call center data of almost 250 million customers due to unsecured Elasticsearch servers. The incident had occurred last year and the exposed information included customer emails, IP addresses, support agent emails, and internal notes.
- Thousands of highly sensitive records, around 19.95 GB of data, of adult models from an adult network were leaked on the internet in a data breach incident due to an unprotected S3 bucket. The leak has exposed the personal data and likeness of over 4,000 models apart from videos, marketing materials, photographs, clips and screenshots of video chats, and zip files.
- A hacker was found selling a huge database of 49 million business contacts on an underground forum that can be used for pitches and sales. The hacker claimed that the data belongs to LimeLeads, a San Francisco-based B2B leads provider. The hacker managed to steal records as the firm failed to set up a password for an internal server.
- A school district in Manor, Texas lost $2.3 million within two months in a phishing scam. The amount was transferred to scammers in three separate transactions between November and December 2019. The Federal Bureau of Investigation (FBI) is currently investigating the matter.
- Minnesota-based hospital operator Alomere Health issued a data breach notice to nearly 50,000 patients that may have been a victim of the attack. The incident occurred after a malicious actor gained access to two employees’ email accounts in late October and early November 2019. The compromised data includes patients’ names, addresses, dates of birth, medical record numbers, health insurance information and diagnosis, and treatment details.
- A database containing the personal details of 56.25 million US residents was exposed from the people-finder website CheckPeople.com, a Florida-based firm. The database, however, was served from a computer with a Chinese IP address associated with Alibaba's web hosting wing in Hangzhou.
- Foreign currency service Travelex was attacked by the Sodinokibi gang—on New Year’s eve—who allegedly demanded $6 million in ransom. The London-based company was forced to take its website and affected systems offline. After almost a month, on December 29, 2019, the company’s international money transfer service and wire services were fully restored. However, the website still remains down.
New Threats
Cybercriminals continue to target firms by finding loopholes and exploiting vulnerabilities in their security infrastructure. Now, Microsoft exposed an ongoing $100 million Evil Corp phishing campaign by TA505 threat actor group. Also, 200 million Broadcom cable modems were at the risk of eavesdropping and traffic re-routing attacks on users. Further, researchers found a new breed of ransomware, dubbed Ako, camouflaged as a request agreement.
-
Microsoft detected an ongoing $100 million Evil Corp phishing campaign that delivers malicious payloads through Excel documents. The new campaign uses HTML redirectors attached to emails. When opened, the HTML leads to the download of Dudear—a malicious macro-laden Excel file that drops the payload. The campaign was being carried out by the TA505 threat actor group.
-
At least 200 million Broadcom-based cable modems were affected by the new Cable Haunt flaw. The flaw allowed attackers to compromise a modem and gain full control over the inbound and outbound traffic. The attackers could also eavesdrop on browsing activity, re-route traffic to malicious domains, or even zombify devices to use them in botnet attacks.
-
Some 5,000 Android phones were reported to be infected by the new version Faketoken Android trojan. The trojan is used to drain its victims’ bank accounts to fuel offensive mass text campaigns targeting mobile devices from all over the world. Once installed on the victim’s device, Faketoken first checks if their bank accounts have enough money. It will then use the stolen payment cards to add credit to the victim’s mobile account.
-
More than 800 computers of a medical firm got compromised in a cyber incident starting October 14, 2019. Threat actors reportedly exploited the WAV audio files to hide the malware modules and later distributed it to vulnerable Windows 7 machines via EternalBlue. The purpose of the infection was to mine cryptocurrencies.
-
Microsoft issued security patches for 49 vulnerabilities, out of which 7 were classified as ‘Critical’, 41 as ‘Important’ and 1 as ‘Moderate’. One of the critical vulnerabilities termed as CryptoAPI spoofing flaw was discovered and reported by the NSA. It could allow attackers to spoof digital certificates to perform Man-in-the-Middle (MITM) attacks.
-
A widely known arbitrary file read vulnerability, tracked as CVE-2019-11510, was found to be exploited in the wild. The flaw could be exploited to infiltrate corporate networks, obtain sensitive information, and eavesdrop on communications. Despite patches being made available by the impacted vendors, many organizations still haven’t applied them, allowing threat actors to leverage the vulnerabilities in their attacks.
-
Ako, a new breed of ransomware, was discovered and reported this month. However, it remained unclear how the ransomware spreads. It was found that the ransomware was distributed via malicious spam emails camouflaged to be a request agreement with title such as ‘Agreement 2020 #1775505’. Such emails included a password-protected zip file named agreement.zip with the password ‘2020’ being given in the email.
-
Iranian state-sponsored hackers were linked to the data-wiper malware attack incident on the network of Bahrain’s national oil company Bapco. Dustman, the new malware, is designed to wipe data on infected computers. The malware appeared to be an upgraded and more advanced version of the ZeroCleare wiper that was discovered last fall.
-
In a sequel to the infamous Operation AppleJeus campaign, the Lazarus threat actor group was found using homemade malware—capable of evading detection—to target Windows and macOS users. The attack campaign used fake cryptocurrency trading websites with links to equally fake Telegram trading groups. So far, the malware has been spotted in the wild on machines located in the UK, Poland, Russia, and China.
-
A malicious extension named Shitcoin Wallet was found stealing passwords and private keys from cryptocurrency wallets and cryptocurrency portals. To initiate the stealing process, the extension requests permission to inject JavaScript code on 77 websites. When users navigate to any of these 77 sites, the extension loads and injects the malicious code that records users’ login credentials, searches for private keys, and sends the data back to the hackers.