Cyware Monthly Threat Intelligence

Monthly Threat Briefing • Aug 3, 2020
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • Aug 3, 2020
Despite a spike in cybersecurity incidents in July, security experts and researchers have managed to make progress in the right direction. In a recent development, Microsoft added a Data Loss Prevention (DLP) feature in Office 365 to prevent data leaks and inappropriate data sharing. On a tangent, Google added 11 new security features to its G Suite products and a Zoom-Bombing prevention feature to Google Meet to thwart growing threats.
Microsoft Office 365 now includes a DLP feature, making it easier for organizations to prevent data leaks, inappropriate data sharing, and other similar risks. The new extension will protect sensitive data and details on devices running Windows 10.
The National Cyber Security Centre (NCSC), the U.K., released a new set of free tools and roleplay exercises to protect remote workers from cyberattacks. The exercises focus on safe access to networks, securing employee collaboration, and managing cyber incidents remotely.
A group of academics developed a new SSO algorithm that aims at securing user information, including usernames and passwords, from being accessed by third-party services and applications.
Google Cloud announced 11 new G Suite security features to help IT administrators manage and secure their devices more effectively. The updates also apply to other G Suite products: Gmail, Chat, and Meet.
Google Meet added a ‘Zoom-Bombing’ prevention feature to protect educators from unwanted intrusion. This will be especially useful for users joining Google Meet video conferences organized through G Suite.
Last month, several firms confirmed being targeted by cyber adversaries and spilling confidential details. According to reports, Xerox Corporation, Blackbaud, Promo[.]com, IndieFlix, and a few other organizations underwent a massive data breach. Meanwhile, the ShinyHunters group was offering over 386 million user records of 18 companies on a hacker forum for free. In other news, a hacker laid bare data from 8,200 databases in a revenge attack.
Blackbaud, the cloud computing provider, notified dozens of charities, organizations, and universities about a data breach it suffered in May. The company had to pay a ransom to stop threat actors from infecting the network further. The Blackbaud breach has affected at least 125 organizations and the victim count is expected to rise.
Xerox Corporation was targeted by the Maze ransomware group. The attackers had breached one of the company’s branches in Europe and stole nearly 100GB worth of data. The group threatened to leak the data if the company doesn’t participate in negotiations for a ransom.
A research team discovered an unsecured Amazon S3 bucket belonging to IndieFlix leaking over 90,000 files related to scans of confidential motion picture acquisition agreements, tax ID requests, and contact details of film professionals.
ShinyHunters was spotted offering data of 18 companies—containing over 386 million user records—on a hacker forum for free. It also contains data from some of the latest breaches, including Promo[.]com and a Microsoft private GitHub repository.
Cosmetic giant, Avon, leaked 19 million records containing personal information and technical logs, due to a misconfigured Elasticsearch database. Among the personal data exposed, it included full names, phone numbers, dates of birth, and email addresses of users.
A trove of 4.8 million records belonging to a well-known U.K.-based ticketing provider was put up for sale on the dark web. The data was sold at a price of $2500 by a user named ‘Jamescarter.’ The affected users are located mainly in the U.K, the U.S., New Zealand, Australia, South Africa, Germany, and France.
FireEye uncovered a pro-Russia disinformation-focused group, dubbed Ghostwriter, that has been spreading fake news about the NATO and the U.S. troops stationed in Poland and the Baltics, by infiltrating Eastern European media outlets. The methods included pushing fake stories on authentic but compromised websites using made-up personas.
McAfee researchers revealed details about Operation North Star that lured employees through fake job offers in the U.S. defense and aerospace sectors via spearphishing campaigns. The operation began in late March and ended around May end.
Drizly, an online alcohol delivery startup, suffered a data breach that affected its 2.5 million customers. Leaked details include email IDs, birth dates, hashed passwords, and delivery addresses. It wasn’t clear how the hack happened; however, the firm has advised users to change their passwords.
A hacker took over nearly 23,000 unsecured MongoDB databases with an intent to get ransom from victim companies. The affected companies were given two days to pay the ransom, failing which the data would be leaked online. Additionally, the hacker threatened to contact the local GDPR authorities to report the leak.
Four misconfigured AWS S3 buckets and one unsecured Elasticsearch database belonging to five e-learning platforms leaked nearly one million records of online students. The five affected platforms were Okoo, Square Panda, Playground Sessions, MyTopDog, and Escola Digital.
Cybercriminals dumped a stolen database of Bhinneka, Indonesia’s largest online store, in the underground marketplace. The database contained over 1.2 million account records with users’ personal information such as full names, addresses, emails, gender, contact numbers, social media IDs, and salted passwords.
Around 15 billion credentials, which could give access to individuals’ bank accounts and companies’ networks, were found for sale on the dark web. These credentials were harvested from over 100,000 discrete data breaches.
A hacker, under the alias NightLion, hijacked more than 8,200 databases and exposed billions of information from the servers of DataViper, a data leak monitoring service firm run by a researcher working at Night Lion Security, in a revenge attack.
Unsecured databases belonging to two Chinese firms—Xiaoxintong and Shanghai Yahua Smartech—had leaked millions of user records. The compromised information included mobile numbers, hashed passwords, and more.
Though cybercriminals are known to work on new threats, they may sometimes return to their old tricks. Recently, researchers disclosed about an old EMV-Bypass cloning technique in use by threat actors to abuse card transactions. In another revelation, security experts said seven ransomware families could be expanding activities to target processes within Operation Technology (OT) software. Moreover, a new Android malware, dubbed BlackRock, was found affecting at least 337 apps.