Cyware Monthly Threat Intelligence

Monthly Threat Briefing • Jul 1, 2021
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • Jul 1, 2021
As the world inches toward more secured communication, a group of academic researchers devised a system that could enable smart home systems to respond to audio commands without invading users' privacy. A joint law enforcement operation by the U.S., European, and other national authorities resulted in a major crackdown on organized crime activities through the use of an encrypted chat platform. Meanwhile, the NSA announced it is funding the development and release of the D3FEND framework to help security professionals tailor their defenses against specific security threats.
Researchers at the University of Michigan developed a system called PrivacyMic that can filter out audible sounds, thereby offering more security and privacy to users of smart home systems.
According to Europol, law enforcement authorities made more than 800 arrests in raids at 700 locations worldwide under Operation Trojan Shield, wherein the police followed upon criminals’ activities via AN0M, an encrypted chat platform.
Researchers at the University of Rochester devised an approach called TimeCache that protects against side-channel attacks like evict+reload and Spectre, with a tiny performance impact.
Google introduced a vulnerability interchange schema with the aim of fortifying open-source security. This new schema will address some major problems with managing open-source vulnerabilities.
The NSA announced it is funding the development and release of the D3FEND framework to help security professionals tailor their defenses against specific security threats.
The DoJ announced that law enforcement agencies from the U.S., Germany, the Netherlands, and Romania took down Slillpp, the largest online marketplace for stolen credentials. The multinational operation seized the servers that hosted Slillpp’s infrastructure and domain names.
Further, ransomware threats, malware operators, and misconfigured databases remained the top threats in the cybersecurity space in June. For instance, a Brazilian medical lab firm and a French fashion label were targeted by a notorious ransomware group. In other news, scammers were sending fake replacement devices to Ledger customers, whereas Crackonosh malware operators reportedly made at least $2 million in illegal Monero mining.
REvil ransomware was held responsible for the attacks on Brazil-based Grupo Fleury and France-based FCUK. The group has asked for $5 million in ransom if the victim wishes to receive a decryptor and avoid data leak.
Following the ransomware attack on the City of Tulsa in May, the attackers posted more than 18,000 stolen files, including police citations and internal department files on the dark web. These files included names, dates of birth, addresses, and driver’s license numbers.
The operator of a malware, named Crackonosh, was discovered to have made more than 9,000 Monero coins after compromising 222,000 Windows computers since 2018. The malware was hidden inside pirated and cracked copies of popular software.
The South Korean Atomic Energy Research Institute (KAERI) has confirmed a cyberattack by the Kimsuky threat actor group. The adversary had exploited a vulnerability in the VPN system used within the research institute’s environment to enter into the network.
Ragnar Locker ransomware group hit Taiwan-based memory and storage manufacturer ADATA and made more than 700GB of archived stolen data public in an attempt to pressurize and extort from the victim.
DirtyMoe, known for cryptomining and DDoS attacks, infected over 100,000 Windows systems, according to researchers. The initial infection process relies on spam emails to lure users to malicious sites hosting an exploit kit named PurpleFox.
Around 20GB of confidential files containing personal information of retail customers was exposed due to an unprotected Amazon AWS bucket. In the same vein, a misconfigured database belonging to Cognyte had exposed more than 5 billion records for three days before security professionals secured it.
An online database containing 204GB of data belonging to CVS Health disclosed over a billion records owing to a misconfiguration issue. The data includes production records of visitor IDs, session IDs, and device access information.
UF Health Central Florida witnessed a blow to its IT network caused due to a ransomware attack. UF Health The Village Hospital and UF Health Leesburg Hospital were incapable of accessing their computer systems and email because of the attack.
Scammers were spotted sending fake replacement devices to Ledger customers affected in a recent data breach in an attempt to steal from their cryptocurrency wallets. Although the device looked legitimate, the printed circuit board was modified.
NFT creators and digital artists were targeted in a Redline malware campaign, enabling the threat actor to swipe the former’s profits. According to reports, the attacker impersonated NFT creators and approached Twitter users with business deals that tricked them into downloading and running a malware-laced file.
Around 8.4 billion entries of passwords were disclosed on a popular hacker forum. The compilation—comprises a 100GB TXT file and goes by the name RockYou2021—was stored in plain text.
Ukrainian public and private sectors were targeted in a massive spear-phishing attack carried out by Russian threat actors. The attack was conducted via emails claiming to be from representatives for the Kyiv Patrol Police Department.
A new cyberattack occurs every few seconds and the following incidents are just a glimpse of the evil creations of cybercriminals. Security researchers uncovered new ransomware operations, such as Ever101, DarkRadiation, and EpsilonRed, targeting various sectors worldwide. Cybercriminals launched a new Mirai variant that milks Tenda router bugs. Also, now we have the first-ever malware pervading through Kubernetes environments via Windows containers.