Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing Feb 3, 2021

**The Good **

Leaving behind the woes of 2020, the cybersecurity fraternity continues to make progress in the new year. Intel made the first-ever system where PC hardware plays a direct role in identifying ransomware instances. Meanwhile, law enforcement authorities shut down the operations of one of the greatest malware threats, while also sealing the doors of the world's largest underground marketplace. Let’s make a toast to the good bits of the month.

  • Intel, at the 2021 Consumer Electronics Show, added ransomware detection capabilities to its new 11th Gen Core vPro processors by improving its Hardware Shield and Threat Detection Technology (TDT).

  • The NSA released guidance to help network security analysts and system administrators in detecting and replacing outdated Transport Layer Security (TLS) protocol versions with up to date and secure variants.

  • Global law enforcement and judicial authorities took Emotet down, one of the most significant botnets used by cybercriminals to launch a variety of malware attacks. They have started spreading a module that will uninstall the malware on March 25, 2021.

  • CSIRO’s Data61, the digital specialist arm of Australia’s National Science Agency, the NSW Government, and other groups developed a privacy tool that adds an extra layer of security to ensure further protection of key datasets, such as those tracking COVID-19.

  • DarkMarket, the world’s largest underground marketplace, was taken down via the joint efforts of law enforcement authorities from the U.K, the U.S., Germany, Denmark, Australia, Ukraine, and Moldova.

The Bad

It goes without saying that attackers are perpetually advancing their toolsets for bigger hunts. During the month, ransomware attacks, breaches were galore, whereas details about SolarWinds attack kept coming forth with new facts. On top of it all, sensitive data were leaked left, right, and center, from various platforms, with ShinyHunters leading the pack.

  • A new report revealed that up to 18,000 SolarWinds customers may have received trojanized updates for their Orion monitoring product. As a result, attackers could establish a backdoor on victim systems and deploy more malware.

  • Retail giant Dairy Farm was attacked by REvil ransomware, following which the attackers demanded $30 million in ransom. Allegedly, the attackers had access to information for seven days after the attack.

  • Nissan revealed leaking the source code of mobile apps and internal tools due to a misconfiguration in one of its Git repositories, a Bitbucket instance. Hackers shared it in the form of Torrent links on Telegram channels and hacking forums.

  • ShinyHunters leaked 70GB of customer data, including card data, after breaking into the cloud backup database of Bonobos, an online men’s clothing store. The group also shared about 1.9 million Pixlr user records on a hacker forum for free.

  • The sensitive data of 325,000 users of the BuyUCoin cryptocurrency exchange was leaked on the dark web. It included the user names, e-mails, mobile numbers, encrypted passwords, wallet details, order details, bank details, KYC details, and deposit history.

  • The IT systems of Palfinger AG, an Austrian firm that makes cranes and other machinery, were taken down due to an ongoing global cyberattack. The attack sabotaged the firm’s e-mail and business operations.

  • A database belonging to Teespring, an e-commerce platform that lets users design and sell custom apparel, was disclosed on a popular hacker forum. The files in the leaked archive included email addresses and last update dates for around 8 million user accounts.

  • Trend Micro researchers found hundreds of networks that were still affected by VPNFilter malware. Believed to be operated by the Sofacy threat actor group, the malware is capable of exfiltrating data, encrypting communications with C2 server, and exploiting endpoints.

  • In an ongoing investigation, Capcom claimed last month that up to 390,000 people may have been affected in a ransomware attack in November. Ragnar Locker had demanded $11 million for the release of 1TB of stolen data from the company.

  • A group of researchers was able to gain access to the Git repositories of the United Nations as part of the Vulnerability Disclosure Program. This resulted in the leak of several user credentials, including over 100,000 private records for the United Nations Environmental Programme employees.

  • The Conti ransomware group crippled OmniTRAX, the Colorado-based short line rail operator and logistics provider, and pilfered data after compromising its parent company, Broe Group. The group leaked a sample of the 70GB files containing the internal OmniTRAX documents.

  • Around 3GB archive of data belonging to the U.S.-based auto parts shop, NameSouth, was publicly leaked by the NetWalker gang, following a failed ransom negotiation. The trove contained financial and accounting data, credit card statements, employee PII, and various legal documents.

New Threats

In the time it takes one to blink, a new threat emerges. The month gave us an old malware with a new ensemble. Android had its own share of threats, one discovered by Google and the other by Italy’s security experts. Further, the cyber landscape saw new scams, new attack campaigns, and vulnerabilities affecting a myriad of systems.

  • A newly discovered phishing toolkit called LogoKit was found to be deployed in the wild. So far, researchers identified the toolkit on more than 300 domains in a week and on over 700 sites in a month.
  • Palo Alto’s Unit 42 is alerting organizations about new updates in Rocke Group’s Pro-Ocean — a cloud-targeted malware used throughout 2018 and 2019 to illegally mine Monero from infected Linux machines. It now includes capabilities such as spreading like a worm and new detection evasion techniques.
  • The FTC issued a warning about a scam that pretends to be from the U.S. regulatory agency. The scam leverages several YouTube links and pop-up sites that claim to protect personal and financial data from being exposed online.
  • Researchers reported the return of the attackers behind the CursedGrabber malware family, which utilizes brandjacking and typosquatting techniques against software supply chains. The attackers published three new malicious NPM packages designed to steal information.
  • A new variant of the NAT Slipstreaming attack, that can bypass mitigations for the previous version of the attack and expand the attacker’s reach, was uncovered by researchers.
  • The investigation of the XHunt campaign resulted in the discovery of two new backdoors called TriFive and Snugy. In addition to this, researchers decoded that BumbleBee web shell and SSH tunnels were used for moving laterally across compromised networks.
  • Babuk Locker surfaced as the first new ransomware family of 2021. Upon launching, it abuses the Windows Restart Manager to spread across network resources. After encryption, it demands ransom ranging between $60,000 and $85,000 in Bitcoins.
  • Google Project Zero researchers uncovered sophisticated hacking campaigns that used Windows and Android zero-day vulnerabilities. Threat actors leveraged these n-days vulnerabilities to exploit two servers delivering different exploit chains via watering hole attacks.
  • Interpol warned of a new investment scam last month targeting mobile dating apps. The modus operandi involves scammers taking advantage of people looking for a potential match and luring them into sophisticated fraud schemes.
  • A number of vulnerabilities discovered in the 123contactform-for-wordpress WordPress plugin can allow attackers to arbitrarily create posts and inject malicious files into the website without any form of authentication.
  • Cybercriminals were spotted using Windows RDP systems to amplify DDoS attacks. Systems in which RDP authentication is enabled on UDP port 3389 on top of the standard TCP port 3389 are susceptible to these attacks.
  • Italy's CERT issued a warning against a new Android malware, named Oscorp, that exploits accessibility services to steal user credentials and record audio and video on mobile screens.
  • Security researchers have observed the first attempts of exploiting Zyxel devices using a recently disclosed vulnerability, CVE-2020-29583. The flaw, that affects several Zyxel firewalls and WLAN controllers, arises due to the hardcoded credentials stored in the firmware.

Related Threat Briefings

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.