Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing Jul 1, 2020

The Good

The COVID-19 pandemic has wiped out many crucial cybersecurity conferences this year but it has not stopped cyber innovators from continuing their work. Last month, researchers at Carnegie Mellon University developed a prototype label for IoT devices that details how the connected devices manage user data and ensure security and privacy. Another research group from CSIRO’s Data61 created a new approach to thwart voice spoofing attacks. Meanwhile, the U.S. government announced its plan to adopt HTTP Strict Transport Security (HSTS) to secure all the [.]gov domains from September 1, 2020, onward.

  • A group of academics at Carnegie Mellon University’s CyLab created a prototype of security and privacy labels for IoT devices to shed light on a device's security posture and, also, explain how it manages user data and privacy controls.

  • Researchers from CSIRO’s Data61 developed a new technique to protect users from voice spoofing attacks that use synthesized speech for voice recognition. The new solution, called Void, identifies the differences in spectral power between a live human voice and a voice replayed through a speaker.

  • With 99% accuracy, researchers at the University of Texas formulated a tool to determine whether an Android game or other kinds of mobile apps comply with the federal Children’s Online Privacy Protection Act (COPPA) or not.

  • Starting from September 1, 2020, all the U.S. [.]gov sites will only be accessible via HTTPS. The protocol will protect visitors’ connections by encrypting exchanged data and protecting them from man-in-the-middle attacks.

  • The CISA planned to roll out a new Domain Name System (DNS) resolver service to ensure the resilience of online systems. The service will also enable the CISA to gain insights into active cyber threats to analyze and protect federal agencies.

The Bad

With all the good that happened last month, the bad is not left behind. The month of June witnessed around a dozen major ransomware attacks that affected firms across different sectors, including LG Electronics, MaxLinear, and IndiaBulls. In other news, hackers claimed to leak 296GB of data stolen from different U.S. law enforcement agencies. Moreover, the City of Florence paid around $300,000 in bitcoin ransom to a hacker group to restore access to its systems.

  • Ransomware continued to run rampant, ransacking the targeted organizations’ sensitive information and networks. While the Maze ransomware gang claimed attacks on LG Electronics and MaxLinear Inc., the operators of CLOP and Nefilim ransomware disrupted the business operations of IndiaBulls and Fisher & Paykel, respectively.

  • A hacktivist group, dubbed ‘Distributed Denial of Secrets’ (DDoSecrets), leaked 296 GB of data associated with more than 200 U.S. law enforcement agencies and fusion centers. The leaked files, dubbed BlueLeaks, included more than one million files, such as emails, videos, audio files, and scanned documents among others.

  • The U.K National Health Service (NHS) confirmed that some 113 internal email accounts were compromised to send malicious spam messages outside the organization. The emails sent using the breached account included a link to a fake login page of the NHS.

  • A threat actor group, named CryptoCore, stole around $200 million from different cryptocurrency exchanges located in the U.S., Japan, and the Middle East. The amount was stolen by the actors over a span of around two years.

  • A misconfigured AWS S3 bucket leaked 845GB of data belonging to different dating apps. The affected apps included 3somes, CougarD, Gay Daddy Bear, Xpal, BBW Dating, SugarD, GHunt, and Herpes Dating.

  • The City of Florence paid a ransom of nearly $300,000 in bitcoin to restore its systems that were affected in a ransomware attack on June 5, 2020. Investigations reveal that it was the act of DoppelPaymer operators.

  • A database containing over 1.2 million user records from the multiplayer game, Stalker Online, was put up for sale on dark web forums. The leaked records included players’ usernames, passwords, email addresses, phone numbers, and IP addresses.

  • Several websites belonging to different Australian financial institutions, law firms, and entertainment companies were put up for sale on MagBo underground forum. The access to these websites was sold at prices up to $10,000.

  • The Sodinokibi ransomware operators leaked the files allegedly stolen from the U.K power grid company, Elexon, after the ransom demand wasn’t met. The firm was attacked in May 2020.

  • Coincheck cryptocurrency exchange was hit in a cyberattack after hackers gained access to some emails sent by customers. These emails included names, dates of births, and phone numbers of customers.

New Threats

In the meantime, researchers worldwide unmasked numerous threats affecting insecure systems and networks. Researchers reported two new malware NitroHack and Lucifer used in recent attack campaigns. Further, the Valak malware was spotted with a new information stealing capability using a plugin called ‘clientgrabber.’ In addition to these, researchers found the Ginp mobile malware, which usually targets Spain, Poland, and the U.K, spreading its wings to Turkey.

  • A new study found that around 80,000 printers are exposed online via the Internet Printing Protocol (IPP) port on a daily basis. This indicates that attackers can collect printers’ names, locations, models, and even organization names just scanning the IPP port.
  • A multi-stage attack, distributed via a malicious Word document, disguised as a resume to users worldwide. In the last stage, the threat actors used Cobalt Strike’s Malleable C2 feature to download the final payload and perform C2 communication.
  • Security researchers discovered two new malware NitroHack and Lucifer in different attack campaigns. While NitroHack modifies the Discord client for Windows into an infostealing trojan, Lucifer includes cryptocurrency and DDoS capabilities.
  • The full impact of the newly discovered Ripple20 vulnerability, which arises due to a total of 19 flaws in the TCP/IP protocol from Treck, remains unclear. However, researchers believe that the healthcare sector is particularly affected by the flaw. It has been found that there are six times more vulnerable equipment used in healthcare than in other sectors.
  • Three new ransomware, Hakbit, WastedLocker, and CryCryptor were detected by security experts in the last month. While Hakbit targeted mid-level executives across Austria, Switzerland, and Germany, WasteLocker is a creation of the EvilCorp hacker group. The CryCryptor ransomware was used to target Android users in Canada.
  • The Ginp malware, which is well-known for targeting mobile banking customers in Spain, Poland, and the U.K, expanded its attack campaign to Turkey. Researchers found several fake web pages, mimicking banks in Turkey, designed to distribute the malware.
  • Several U.S. energy providers were targeted by a new malware, dubbed FlowCloud, that gave the TA410 threat actor group total control over compromised devices. The attacks took place between July and November 2019 and the malware was pushed using malicious macros.
  • Security experts discovered two new vulnerabilities, namely CrossTalk and SGAxe, affecting Intel processors. While the former affects some client and Intel Xeon E3 processors, the latter can be successfully used against devices using Intel’s 9th gen Coffee Lake Refresh processors.
  • Valak malware enhanced its stealing capability with a new plugin called ‘clientgrabber.’ With this new addition, the malware can steal email credentials from the registry of a compromised machine.
  • A new ransomware strain, named Tycoon, was found targeting Windows and Linux systems in a recent campaign. It deployed a trojanized Java Runtime Environment (JRE) to hide its malicious intentions. The malware is distributed via insecure internet-facing RDP servers.
  • TrickBot operators used the new BazarBackdoor malware to gain full access to targeted networks. The newly discovered malware was distributed via spearphishing emails that leveraged employee termination notices, customer complaints, and other themes to trick recipients.

Related Threat Briefings

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.