Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing Feb 3, 2020

The Good

Slump back in your favorite chair as we go over all the cybersecurity incidents for the first month of the year 2020. To begin with, let’s learn about all the good developments first. Researchers from Ben-Gurion University introduced first-ever all-optical ‘stealth’ encryption technology. In other news, MITRE released its new ATT&CK framework for Industrial Control Systems (ICS). Also, the National Institute of Standards and Technology (NIST) launched version 1.0 of its Privacy Framework to help businesses manage data privacy issues.

  • BGN Technologies, a subsidiary of Ben-Gurion University, introduced first-ever all-optical ‘stealth’ encryption technology that will strengthen the security and privacy of highly sensitive cloud-computing and data center network transmission. This technology is an extension of the digital optical encryption method originally invented at Bar Ilan University.

  • MITRE released a new ATT&CK knowledge-base of the tactics and techniques that cybercriminals use while attacking Industrial Control Systems (ICS). The framework highlights the unique aspects of the specialized applications and protocols that system operators typically use, and which adversaries can take advantage of.

  • The National Institute of Standards and Technology (NIST) released version 1.0 of its Privacy Framework to help improve organizations’ approach to using and protecting personal data. The voluntary tool can not only assist organizations in managing privacy risk arising from their products and services but also demonstrate compliance with laws that may affect them.

  • The Department of Homeland Security and the General Services Administration proposed a centralized vulnerability disclosure platform that could serve as a primary point of entry for security researchers analyzing flaws in government systems. The platform is likely to be managed by CISA, while other agencies might have to kick in some of their own funding.

The Bad

There were also numerous cases of breaches this month that caused potential harm to millions of individuals. Cybercriminals posted payment card details of more than 30 million Americans and over one million foreigners for sale on Joker's Stash, traces of which were linked with the Wawa Inc. database breach. Also, the stolen data from Toronto-based firm Bird Construction was published by ransomware attackers after it denied their demands. Meanwhile, researchers reported Microsoft’s unsecured Elasticsearch servers exposing call center data of almost 250 million customers.

  • Cybercriminals reportedly uploaded payment card details of more than 30 million Americans and over one million foreigners for sale on the Joker's Stash forum. The experts have traced the card data back to Wawa Inc breach from December 2019. According to Wawa, the malware operated without being detected for months, between March 4 and December 12, 2019.

  • Bird Construction, a Toronto-based construction company, suffered a ransomware attack likely by the Maze operators. The attackers claimed to have stolen 60 GB of data including 48 contract deals worth $406 million. Now, the Maze actors have published troves of data it claims to have stolen from Bird Construction.

  • Researched noted that Microsoft had briefly exposed call center data of almost 250 million customers due to unsecured Elasticsearch servers. The incident had occurred last year and the exposed information included customer emails, IP addresses, support agent emails, and internal notes.

  • Thousands of highly sensitive records, around 19.95 GB of data, of adult models from an adult network were leaked on the internet in a data breach incident due to an unprotected S3 bucket. The leak has exposed the personal data and likeness of over 4,000 models apart from videos, marketing materials, photographs, clips and screenshots of video chats, and zip files.

  • A hacker was found selling a huge database of 49 million business contacts on an underground forum that can be used for pitches and sales. The hacker claimed that the data belongs to LimeLeads, a San Francisco-based B2B leads provider. The hacker managed to steal records as the firm failed to set up a password for an internal server.

  • A school district in Manor, Texas lost $2.3 million within two months in a phishing scam. The amount was transferred to scammers in three separate transactions between November and December 2019. The Federal Bureau of Investigation (FBI) is currently investigating the matter.

  • Minnesota-based hospital operator Alomere Health issued a data breach notice to nearly 50,000 patients that may have been a victim of the attack. The incident occurred after a malicious actor gained access to two employees’ email accounts in late October and early November 2019. The compromised data includes patients’ names, addresses, dates of birth, medical record numbers, health insurance information and diagnosis, and treatment details.

  • A database containing the personal details of 56.25 million US residents was exposed from the people-finder website CheckPeople.com, a Florida-based firm. The database, however, was served from a computer with a Chinese IP address associated with Alibaba's web hosting wing in Hangzhou.

  • Foreign currency service Travelex was attacked by the Sodinokibi gang—on New Year’s eve—who allegedly demanded $6 million in ransom. The London-based company was forced to take its website and affected systems offline. After almost a month, on December 29, 2019, the company’s international money transfer service and wire services were fully restored. However, the website still remains down.

New Threats

Cybercriminals continue to target firms by finding loopholes and exploiting vulnerabilities in their security infrastructure. Now, Microsoft exposed an ongoing $100 million Evil Corp phishing campaign by TA505 threat actor group. Also, 200 million Broadcom cable modems were at the risk of eavesdropping and traffic re-routing attacks on users. Further, researchers found a new breed of ransomware, dubbed Ako, camouflaged as a request agreement.

  • Microsoft detected an ongoing $100 million Evil Corp phishing campaign that delivers malicious payloads through Excel documents. The new campaign uses HTML redirectors attached to emails. When opened, the HTML leads to the download of Dudear—a malicious macro-laden Excel file that drops the payload. The campaign was being carried out by the TA505 threat actor group.

  • At least 200 million Broadcom-based cable modems were affected by the new Cable Haunt flaw. The flaw allowed attackers to compromise a modem and gain full control over the inbound and outbound traffic. The attackers could also eavesdrop on browsing activity, re-route traffic to malicious domains, or even zombify devices to use them in botnet attacks.

  • Some 5,000 Android phones were reported to be infected by the new version Faketoken Android trojan. The trojan is used to drain its victims’ bank accounts to fuel offensive mass text campaigns targeting mobile devices from all over the world. Once installed on the victim’s device, Faketoken first checks if their bank accounts have enough money. It will then use the stolen payment cards to add credit to the victim’s mobile account.

  • More than 800 computers of a medical firm got compromised in a cyber incident starting October 14, 2019. Threat actors reportedly exploited the WAV audio files to hide the malware modules and later distributed it to vulnerable Windows 7 machines via EternalBlue. The purpose of the infection was to mine cryptocurrencies.

  • Microsoft issued security patches for 49 vulnerabilities, out of which 7 were classified as ‘Critical’, 41 as ‘Important’ and 1 as ‘Moderate’. One of the critical vulnerabilities termed as CryptoAPI spoofing flaw was discovered and reported by the NSA. It could allow attackers to spoof digital certificates to perform Man-in-the-Middle (MITM) attacks.

  • A widely known arbitrary file read vulnerability, tracked as CVE-2019-11510, was found to be exploited in the wild. The flaw could be exploited to infiltrate corporate networks, obtain sensitive information, and eavesdrop on communications. Despite patches being made available by the impacted vendors, many organizations still haven’t applied them, allowing threat actors to leverage the vulnerabilities in their attacks.

  • Ako, a new breed of ransomware, was discovered and reported this month. However, it remained unclear how the ransomware spreads. It was found that the ransomware was distributed via malicious spam emails camouflaged to be a request agreement with title such as ‘Agreement 2020 #1775505’. Such emails included a password-protected zip file named agreement.zip with the password ‘2020’ being given in the email.

  • Iranian state-sponsored hackers were linked to the data-wiper malware attack incident on the network of Bahrain’s national oil company Bapco. Dustman, the new malware, is designed to wipe data on infected computers. The malware appeared to be an upgraded and more advanced version of the ZeroCleare wiper that was discovered last fall.

  • In a sequel to the infamous Operation AppleJeus campaign, the Lazarus threat actor group was found using homemade malware—capable of evading detection—to target Windows and macOS users. The attack campaign used fake cryptocurrency trading websites with links to equally fake Telegram trading groups. So far, the malware has been spotted in the wild on machines located in the UK, Poland, Russia, and China.

  • A malicious extension named Shitcoin Wallet was found stealing passwords and private keys from cryptocurrency wallets and cryptocurrency portals. To initiate the stealing process, the extension requests permission to inject JavaScript code on 77 websites. When users navigate to any of these 77 sites, the extension loads and injects the malicious code that records users’ login credentials, searches for private keys, and sends the data back to the hackers.

Related Threat Briefings

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.