Cyware Monthly Threat Intelligence
Monthly Threat Briefing • Feb 2, 2022
We use cookies to improve your experience. Do you accept?
Monthly Threat Briefing • Feb 2, 2022
Every January, we hope for a better year in cybersecurity with improvements in cyber resilience for all. Researchers intensified the hope by developing a silk-based physical unclonable function with applications in authentication mechanisms and data encryption. In another streak, the U.S. announced an action plan to boost cyber resilience for the water sector. Also, the U.S. Cyber Command entered a partnership with universities to prepare graduates for military cyber roles.
Researchers from the South Korean Gwangju Institute of Science and Technology (GIST) developed a way to enhance digital security by using silk fibers to generate encryption keys. The paper published by them argues that silk properties could be leveraged to create Physical Unclonable Functions (PUFs). The researchers used a light-reflecting mirror, three light-emitting diodes, and an image sensor to capture patterns of light reflected off the silk to build a security tag pattern.
The White House, CISA, and Environmental Protection Agency (EPA) launched a 100-day plan to strengthen the cybersecurity of the nation’s water systems. Dubbed the Industrial Control Systems Cybersecurity Initiative—Water and Wastewater Sector Action Plan, the plan will develop a task force of water utility industry leaders, boost incident monitoring pilot programs, offer technical support to water systems in distress, and enhance information sharing.
Researchers from the University of California, Santa Barbara, (UCSB) developed a scalable technique to scrutinize smart contracts and remove state-inconsistency vulnerabilities. The process assisted them in identifying 47 zero-day bugs in the Ethereum blockchain. Dubbed Sailfish, the technique audits the smart contract’s source pre-deployment and delivers a bug-free contract as smart contracts are not readily upgradable.
The U.S. Cyber Command announced a partnership with 84 colleges and universities from 34 states and the District of Columbia to bridge the cybersecurity talent gap in the U.S. military. The partners include nine minority-serving institutions, 13 community colleges, 69 universities, four military war and staff colleges, and four military service academies.
Last month, multiple stories unfolded around Ukrainian cyberattacks with a variety of malware threats targeting the country's critical infrastructure. The crypto landscape also registered two new victim organizations with over $100 million lost to hackers. 2FA is a must but be wary of this malicious app calling itself 2FA Authenticator as it infected nearly 10,000 devices with a hidden malware.
Dozens of Ukrainian government websites were defaced by Russian cybercriminals. The defaced websites were displayed with messages written in Russian, Ukrainian, and Polish languages. The campaign abused compromised Content Management Systems (CMS) to disseminate fake news.
DeFi platform Qubit Finance witnessed a loss of $80 million in BNB coins after cybercriminals exploited a bug in the firm’s network system. Meanwhile, Crypto[.]com revealed missing $31 million in crypto funds from the wallets of 483 individuals.
A large-scale cyberespionage campaign, active since at least 2019, is targeting renewable energy and industrial technology organizations. Threat actors behind the campaign used legitimate websites, DNS scans, and public sandbox submissions to steal the login credentials of employees. The targeted organizations include Schneider Electric, Honeywell, Huawei, Telekom Romania, University of Wisconsin, Utah State University, and Taiwan Forestry Research Institute, among others.
Marketing giant RR Donnelly (RRD) underwent a Conti ransomware attack that disrupted the IT systems, making its customers unable to receive printed documents required for vendor payments, disbursement checks, and motor vehicle documentation. The attackers claimed responsibility and leaked 2.5GB of the stolen data.
Finland’s National Cyber Security Centre (NCSC-Fi) warned of an ongoing phishing campaign trying to take over Facebook accounts by pretending to be the victims’ friends in Messenger chat. The agency stated that Facebook users who received texts from online acquaintances for their phone numbers and verification number are victims of the scam.
An AWS S3 bucket leak affected the sensitive data—API keys, user data, internal messaging systems, and cloud systems—of gaming giant SEGA. in addition to this, other leaked data include multiple sets of AWS keys providing access to all of SEGA Europe’s cloud systems, MailChimp and Steam API keys, and hundreds of thousands of the Football Managers forum members’ data.
A report by New York’s OAG states that around 17 well-known online retailers, restaurant chains, and food delivery services were targeted in credential stuffing attacks over the past several months. The OAG confirmed the attacks after investigating thousands of posts containing credentials of more than 1.1 million customer accounts.
Nearly 70 investors fell victim to a long-running internet-based fraud operation that tricked them with various investment opportunities. The victims were directed to 150 different fraudulent sites as a part of the scam carried out by a cybercriminal posing as FINRA broker-dealers. The scam went on for eight long years and the attackers gained over $50 million from the investors.
Finalsite, a U.S.-based digital marketing and communications solutions provider to schools, suffered a ransomware attack resulting in thousands of school websites going offline. Around 8,000 schools across 110 countries are claimed to use services provided by the company. However, no evidence of data theft has yet been found.
A ransomware attack led to an unplanned lockdown of the Metropolitan Detention Center, Bernalillo County, New Mexico. The attack impacted the local government systems, including the ones used to manage the prison. It is suspected that the attack corrupted several databases, including an incident tracker.
French cosmetic company Clarins was hit by a data breach that affected the personal information of Singapore customers. The incident occurred as the company failed to patch the Log4Shell vulnerabilities on time. The data affected include names, addresses, email, phone numbers, and loyalty program status of customers.
Around 50 top-notch FIFA Ultimate Team traders were the subjects of a cyberattack, in which the attackers made off with the victims’ FIFA points and coins. Electronic Arts (EA) blamed the attack on human error that resulted in the loss of access to accounts and thousands of dollars of in-game currency for the victims.
Around 39 million patient records leaked from Bangkok-based Siriraj Hospital have been offered for sale on a dark web forum. These records contain names, addresses, Thai IDs, phone numbers, gender details, and dates of birth of users. Some of the data also belongs to the Siriraj Piyamaharajkarun Hospital, containing records of VIP patients.
A malicious 2FA Authenticator app was removed from the Google Play Store after over 10,000 downloads. The fully functional app came loaded with the Vultur stealer, aiming to steal financial and banking information from the victims. By asking for extra permissions, the scam app was also able to access user location data, disable password and device lock security, and take control of the device even if it is switched off.
A cyberattack is no longer a question of ‘if’ but, it’s a matter of ‘when.’ More new ransomware threats have emerged in cyberspace with existing ones continuing to hone their skills with new tools. Furthermore, there’s a rise in malicious bootkits with the third custom UEFI firmware implant being identified as MoonBounce.