Cyware Monthly Threat Intelligence

Monthly Threat Briefing • Jul 1, 2020
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • Jul 1, 2020
The COVID-19 pandemic has wiped out many crucial cybersecurity conferences this year but it has not stopped cyber innovators from continuing their work. Last month, researchers at Carnegie Mellon University developed a prototype label for IoT devices that details how the connected devices manage user data and ensure security and privacy. Another research group from CSIRO’s Data61 created a new approach to thwart voice spoofing attacks. Meanwhile, the U.S. government announced its plan to adopt HTTP Strict Transport Security (HSTS) to secure all the [.]gov domains from September 1, 2020, onward.
A group of academics at Carnegie Mellon University’s CyLab created a prototype of security and privacy labels for IoT devices to shed light on a device's security posture and, also, explain how it manages user data and privacy controls.
Researchers from CSIRO’s Data61 developed a new technique to protect users from voice spoofing attacks that use synthesized speech for voice recognition. The new solution, called Void, identifies the differences in spectral power between a live human voice and a voice replayed through a speaker.
With 99% accuracy, researchers at the University of Texas formulated a tool to determine whether an Android game or other kinds of mobile apps comply with the federal Children’s Online Privacy Protection Act (COPPA) or not.
Starting from September 1, 2020, all the U.S. [.]gov sites will only be accessible via HTTPS. The protocol will protect visitors’ connections by encrypting exchanged data and protecting them from man-in-the-middle attacks.
The CISA planned to roll out a new Domain Name System (DNS) resolver service to ensure the resilience of online systems. The service will also enable the CISA to gain insights into active cyber threats to analyze and protect federal agencies.
With all the good that happened last month, the bad is not left behind. The month of June witnessed around a dozen major ransomware attacks that affected firms across different sectors, including LG Electronics, MaxLinear, and IndiaBulls. In other news, hackers claimed to leak 296GB of data stolen from different U.S. law enforcement agencies. Moreover, the City of Florence paid around $300,000 in bitcoin ransom to a hacker group to restore access to its systems.
Ransomware continued to run rampant, ransacking the targeted organizations’ sensitive information and networks. While the Maze ransomware gang claimed attacks on LG Electronics and MaxLinear Inc., the operators of CLOP and Nefilim ransomware disrupted the business operations of IndiaBulls and Fisher & Paykel, respectively.
A hacktivist group, dubbed ‘Distributed Denial of Secrets’ (DDoSecrets), leaked 296 GB of data associated with more than 200 U.S. law enforcement agencies and fusion centers. The leaked files, dubbed BlueLeaks, included more than one million files, such as emails, videos, audio files, and scanned documents among others.
The U.K National Health Service (NHS) confirmed that some 113 internal email accounts were compromised to send malicious spam messages outside the organization. The emails sent using the breached account included a link to a fake login page of the NHS.
A threat actor group, named CryptoCore, stole around $200 million from different cryptocurrency exchanges located in the U.S., Japan, and the Middle East. The amount was stolen by the actors over a span of around two years.
A misconfigured AWS S3 bucket leaked 845GB of data belonging to different dating apps. The affected apps included 3somes, CougarD, Gay Daddy Bear, Xpal, BBW Dating, SugarD, GHunt, and Herpes Dating.
The City of Florence paid a ransom of nearly $300,000 in bitcoin to restore its systems that were affected in a ransomware attack on June 5, 2020. Investigations reveal that it was the act of DoppelPaymer operators.
A database containing over 1.2 million user records from the multiplayer game, Stalker Online, was put up for sale on dark web forums. The leaked records included players’ usernames, passwords, email addresses, phone numbers, and IP addresses.
Several websites belonging to different Australian financial institutions, law firms, and entertainment companies were put up for sale on MagBo underground forum. The access to these websites was sold at prices up to $10,000.
The Sodinokibi ransomware operators leaked the files allegedly stolen from the U.K power grid company, Elexon, after the ransom demand wasn’t met. The firm was attacked in May 2020.
Coincheck cryptocurrency exchange was hit in a cyberattack after hackers gained access to some emails sent by customers. These emails included names, dates of births, and phone numbers of customers.
In the meantime, researchers worldwide unmasked numerous threats affecting insecure systems and networks. Researchers reported two new malware NitroHack and Lucifer used in recent attack campaigns. Further, the Valak malware was spotted with a new information stealing capability using a plugin called ‘clientgrabber.’ In addition to these, researchers found the Ginp mobile malware, which usually targets Spain, Poland, and the U.K, spreading its wings to Turkey.