Cyware Monthly Threat Intelligence
Monthly Threat Briefing • July 1, 2020
The Good
The COVID-19 pandemic has wiped out many crucial cybersecurity conferences this year but it has not stopped cyber innovators from continuing their work. Last month, researchers at Carnegie Mellon University developed a prototype label for IoT devices that details how the connected devices manage user data and ensure security and privacy. Another research group from CSIRO’s Data61 created a new approach to thwart voice spoofing attacks. Meanwhile, the U.S. government announced its plan to adopt HTTP Strict Transport Security (HSTS) to secure all the [.]gov domains from September 1, 2020, onward.
- A group of academics at Carnegie Mellon University’s CyLab created a prototype of security and privacy labels for IoT devices to shed light on a device's security posture and, also, explain how it manages user data and privacy controls.
- Researchers from CSIRO’s Data61 developed a new technique to protect users from voice spoofing attacks that use synthesized speech for voice recognition. The new solution, called Void, identifies the differences in spectral power between a live human voice and a voice replayed through a speaker.
- With 99% accuracy, researchers at the University of Texas formulated a tool to determine whether an Android game or other kinds of mobile apps comply with the federal Children’s Online Privacy Protection Act (COPPA) or not.
- Starting from September 1, 2020, all the U.S. [.]gov sites will only be accessible via HTTPS. The protocol will protect visitors’ connections by encrypting exchanged data and protecting them from man-in-the-middle attacks.
- The CISA planned to roll out a new Domain Name System (DNS) resolver service to ensure the resilience of online systems. The service will also enable the CISA to gain insights into active cyber threats to analyze and protect federal agencies.
The Bad
With all the good that happened last month, the bad is not left behind. The month of June witnessed around a dozen major ransomware attacks that affected firms across different sectors, including LG Electronics, MaxLinear, and IndiaBulls. In other news, hackers claimed to leak 296GB of data stolen from different U.S. law enforcement agencies. Moreover, the City of Florence paid around $300,000 in bitcoin ransom to a hacker group to restore access to its systems.
- Ransomware continued to run rampant, ransacking the targeted organizations’ sensitive information and networks. While the Maze ransomware gang claimed attacks on LG Electronics and MaxLinear Inc., the operators of CLOP and Nefilim ransomware disrupted the business operations of IndiaBulls and Fisher & Paykel, respectively.
- A hacktivist group, dubbed ‘Distributed Denial of Secrets’ (DDoSecrets), leaked 296 GB of data associated with more than 200 U.S. law enforcement agencies and fusion centers. The leaked files, dubbed BlueLeaks, included more than one million files, such as emails, videos, audio files, and scanned documents among others.
- The U.K National Health Service (NHS) confirmed that some 113 internal email accounts were compromised to send malicious spam messages outside the organization. The emails sent using the breached account included a link to a fake login page of the NHS.
- A threat actor group, named CryptoCore, stole around $200 million from different cryptocurrency exchanges located in the U.S., Japan, and the Middle East. The amount was stolen by the actors over a span of around two years.
- A misconfigured AWS S3 bucket leaked 845GB of data belonging to different dating apps. The affected apps included 3somes, CougarD, Gay Daddy Bear, Xpal, BBW Dating, SugarD, GHunt, and Herpes Dating.
- The City of Florence paid a ransom of nearly $300,000 in bitcoin to restore its systems that were affected in a ransomware attack on June 5, 2020. Investigations reveal that it was the act of DoppelPaymer operators.
- A database containing over 1.2 million user records from the multiplayer game, Stalker Online, was put up for sale on dark web forums. The leaked records included players’ usernames, passwords, email addresses, phone numbers, and IP addresses.
- Several websites belonging to different Australian financial institutions, law firms, and entertainment companies were put up for sale on MagBo underground forum. The access to these websites was sold at prices up to $10,000.
- The Sodinokibi ransomware operators leaked the files allegedly stolen from the U.K power grid company, Elexon, after the ransom demand wasn’t met. The firm was attacked in May 2020.
- Coincheck cryptocurrency exchange was hit in a cyberattack after hackers gained access to some emails sent by customers. These emails included names, dates of births, and phone numbers of customers.
New Threats
In the meantime, researchers worldwide unmasked numerous threats affecting insecure systems and networks. Researchers reported two new malware NitroHack and Lucifer used in recent attack campaigns. Further, the Valak malware was spotted with a new information stealing capability using a plugin called ‘clientgrabber.’ In addition to these, researchers found the Ginp mobile malware, which usually targets Spain, Poland, and the U.K, spreading its wings to Turkey.
- A new study found that around 80,000 printers are exposed online via the Internet Printing Protocol (IPP) port on a daily basis. This indicates that attackers can collect printers’ names, locations, models, and even organization names just scanning the IPP port.
- A multi-stage attack, distributed via a malicious Word document, disguised as a resume to users worldwide. In the last stage, the threat actors used Cobalt Strike’s Malleable C2 feature to download the final payload and perform C2 communication.
- Security researchers discovered two new malware NitroHack and Lucifer in different attack campaigns. While NitroHack modifies the Discord client for Windows into an infostealing trojan, Lucifer includes cryptocurrency and DDoS capabilities.
- The full impact of the newly discovered Ripple20 vulnerability, which arises due to a total of 19 flaws in the TCP/IP protocol from Treck, remains unclear. However, researchers believe that the healthcare sector is particularly affected by the flaw. It has been found that there are six times more vulnerable equipment used in healthcare than in other sectors.
- Three new ransomware, Hakbit, WastedLocker, and CryCryptor were detected by security experts in the last month. While Hakbit targeted mid-level executives across Austria, Switzerland, and Germany, WasteLocker is a creation of the EvilCorp hacker group. The CryCryptor ransomware was used to target Android users in Canada.
- The Ginp malware, which is well-known for targeting mobile banking customers in Spain, Poland, and the U.K, expanded its attack campaign to Turkey. Researchers found several fake web pages, mimicking banks in Turkey, designed to distribute the malware.
- Several U.S. energy providers were targeted by a new malware, dubbed FlowCloud, that gave the TA410 threat actor group total control over compromised devices. The attacks took place between July and November 2019 and the malware was pushed using malicious macros.
- Security experts discovered two new vulnerabilities, namely CrossTalk and SGAxe, affecting Intel processors. While the former affects some client and Intel Xeon E3 processors, the latter can be successfully used against devices using Intel’s 9th gen Coffee Lake Refresh processors.
- Valak malware enhanced its stealing capability with a new plugin called ‘clientgrabber.’ With this new addition, the malware can steal email credentials from the registry of a compromised machine.
- A new ransomware strain, named Tycoon, was found targeting Windows and Linux systems in a recent campaign. It deployed a trojanized Java Runtime Environment (JRE) to hide its malicious intentions. The malware is distributed via insecure internet-facing RDP servers.
- TrickBot operators used the new BazarBackdoor malware to gain full access to targeted networks. The newly discovered malware was distributed via spearphishing emails that leveraged employee termination notices, customer complaints, and other themes to trick recipients.