Cyware Monthly Threat Intelligence

Monthly Threat Briefing • Aug 1, 2023
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • Aug 1, 2023
Significant advancements in cybersecurity measures have been made recently by the U.S. General Services Administration (GSA). It has taken two important steps: enhancing identity verification with a new program and allocating significant funds to fortify the cybersecurity posture of the Department of Labor and Environmental Protection Agency. In a notable move towards enhancing vulnerability assessment, the Forum of Incident Response and Security Teams (FIRST) has publicly launched CVSS 4.0.
The GSA released a new program roadmap to improve the identity and verification capabilities of Login[.]gov and comply with security standards. Meanwhile, the GSA’s Technology Modernization Fund set aside five new investments to improve the cybersecurity postures for the Department of Labor and Environmental Protection Agency. While the Labor Department will use $15.2 million for zero-trust architecture, the EPA will invest its $2.5 million into the security of its analytical radiation data system.
A new version of the Common Vulnerability Scoring System (CVSS 4.0), which solves the loopholes discovered in CVSS version 3.1, has been unveiled by the Forum of Incident Response and Security Teams (FIRST). Some of the improvements include the addition of new base metrics, a focus on OT/ICS/safety systems, and enhanced disclosure of impact metrics.
New regulations were proposed by the U.S. Federal Communications Commission to safeguard customer accounts from SIM switching and port-out scams. Under the proposed rules, wireless operators would have to deploy secure methods of user authentication before moving a SIM card to a new device or a phone number to a different network.
In a series of alarming cyber incidents, multiple high-profile organizations have fallen victim to data breaches and cyberattacks, raising concerns over data security. The Egyptian Ministry of Health and Population experienced a massive data breach. Pepsi Bottling Ventures also suffered a significant breach, exposing the sensitive personal, financial, and health data of employees. The North Korean Lazarus hacking group orchestrated a daring $60 million cryptocurrency heist at Alphapo, leaving its mark on the digital world.
The Egyptian Ministry of Health and Population suffered a data breach wherein threat actors stole approximately two million records and offered them for sale on the Popürler hacking forum. The attackers provided a sample dataset of 1,000 people, containing their names, IDs, phone numbers, addresses, diagnosis details, and treatment information.
In a public announcement, Pepsi Bottling Ventures revealed that the personal, financial, and health information of over 28,000 employees was impacted in a data breach that occurred between December 23, 2022, and January 19, 2023. The incident was the result of attackers gaining unauthorized access to certain systems. The compromised data includes names, email addresses, ID numbers, Social Security numbers, medical history details, and health insurance information.
The North Korean Lazarus hacking group was found behind the $60 million cryptocurrency heist at Alphapo. The theft includes over 6 million USDT, 108k USDC, 100.2 million FTN, 430k TFL, 2.5k ETH, 1,700 DAI, and $37M of TRON and BTC, all of which were stolen from hot wallets, possibly using leaked private keys. The attack was carried out on July 23.
An analysis of nearly 20 million information-stealing malware logs revealed that approximately 400,000 corporate credentials are being sold on hacker forums and Telegram channels. Some of these belong to business applications such as Salesforce, Hubspot, Quickbooks, AWS, GCP, Okta, and DocuSign.
Yamaha’s Canadian music division confirmed dealing with a cyberattack after BlackByte and Akira ransomware groups claimed to have targeted the company. While BlackByte added the company’s name to its list of victims on June 14, Akira listed the company’s name on July 21. According to the official statement, the attack led to unauthorized access to systems and the theft of sensitive data.
Tampa General Hospital, Florida, revealed sensitive data of more than 1.2 million patients was stolen during an attempted ransomware attack in May. This sensitive information includes names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance information, and medical record numbers of patients. The electronic medical record system was not accessed by hackers, reported the hospital.
U.S. cosmetics conglomerate Estée Lauder suffered a cyberattack, with BlackCat and Cl0p claiming responsibility by adding the organization to their respective victims’ lists. The BlackCat group claimed that it stole more than 130GB of the company’s data but did not encrypt the network. The Cl0p group even added 62 clients of EY to its leak site, including 3TB of critical information such as client folders, passport scans, visa scans, risk and asset management documents, contracts, and agreements.
Nickelodeon suffered a data breach that allegedly caused the leak of 500GB of confidential data, including unreleased television shows, scripts, and other material. The leak is said to have originated from the ‘consumer products and experience’ portal and was initially detected in January on Discord.
Suncor Energy confirmed that an unauthorized party breached its IT network on or around June 21 to access the basic information of Petro-Points members. The company did not disclose how many members were affected but plans to notify customers if it finds out additional data was accessed.
An unprotected database was found exposing around 725.8GB of data, containing over 8 million records of users and employees. The database belonged to Poorvika, one of India’s largest tech retailers. The records contained personal information such as dates of birth, marital status, family dependencies, tax invoices, and more.
Recent cybersecurity incidents exposed significant vulnerabilities across various software systems, raising concerns among organizations and users alike. Ivanti's Endpoint Manager Mobile (EPMM) was targeted by threat actors exploiting highly-critical bugs. Meanwhile, NoEscape, a rebranded version of Avaddon ransomware, wreaked havoc on enterprises through double extortion attacks, encrypting files on Windows, Linux, and VMWare ESXi servers. The emergence of new malware variants like Abyss Locker and CherryBlos/FakeTrade further added to the complexity of the cybersecurity landscape.