Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing • December 2, 2019

The Good

November just rolled by and it’s time to recollect the cybersecurity happenings of the past month. To begin with, let’s first glance through all the good that has happened in cyberspace this month. The Cybersecurity Protocol for International Arbitration (2020), a set of detailed guidelines on cybersecurity measures for individual arbitration matters was released. Google has launched an initiative called ‘OpenTitan’ that focuses on the cybersecurity posture of devices in data centers. In other news, the U.S. Air Force plans to launch ‘Infrastructure Asset Pre-Assessment program’, a program to rate the cybersecurity of commercial satellite communication companies.

  • The Cybersecurity Protocol for International Arbitration (2020), a detailed guideline set on cybersecurity measures for individual arbitration matters was released as part of New York Arbitration Week. These guidelines were the work of a cybersecurity group including representatives from the New York City Bar Association (City Bar), the International Institute for Conflict Prevention & Resolution (CPR), and the International Council for Commercial Arbitration (ICCA).
  • Google has launched a new open-source silicon root of trust project. Named ‘OpenTitan’, this project focuses on boosting the cybersecurity posture of servers, storage, and other devices in data centers. OpenTitan is said to be managed by lowRISC, a non-profit organization.
  • The U.S. Air Force is planning to launch a cybersecurity program called ‘Infrastructure Asset Pre-Assessment program’ for satellite communication companies to streamline pre-assessment procedures for contractors. According to this program, satellite communication providers must undergo assessments to ensure that they meet the National Institute of Standards and Technology regulations.
  • The U.S. Internal Revenue Service is planning to launch a cyber safety campaign that coincides with the year’s busiest online shopping period. Named ‘National Tax Security Awareness Week 2019’, the campaign is set to run from December 2 through December 6. YouTube videos that educate shoppers are said to form an important part of the campaign.
  • The state of Virginia has developed a new model for quantifying cybersecurity risk and prioritizing defenses. This model is said to be an adaptation of multiple standards for quantifying risk. The model’s accuracy was tested by comparing the outcomes of past breaches with known variables against the model’s predictions, and numbers were found to be fairly close.
  • Google announced a partnership called ‘App Defense Alliance’ with three cybersecurity firms. This collaboration will aim at enhancing the detection of Potentially Harmful Applications (PHAs). The partners will analyze the dataset before an application goes live on the Google Play Store.

The Bad

This month witnessed several cyber incidents. An unsecured Elasticsearch database exposed over 4 terabytes of data, impacting more than 1.2 billion people. The U.S. branch of T-Mobile disclosed a security breach that impacted the details of some customers of its prepaid service. Meanwhile, major hosting provider SmarterASP fell victim to a ransomware attack.

  • An open Elasticsearch database was found to be leaking more than 4 terabytes of data associated with People Data Labs and OxyData, two data enrichment companies. Personal and social information of over 1.2 billion people were said to be impacted by this leak. Researchers have not been able to attribute the database to a specific company.
  • The U.S. branch of T-Mobile announced a security breach that affected some customers of its prepaid service. The exposed data included customer names, phone numbers, account numbers, billing addresses, rate plans, and plan features. The company said that no sensitive information was compromised.
  • SmarterASP, a major hosting provider, was hit by a ransomware attack. Apart from encrypting customer data, the attack also caused downtime for the company’s website. The company said that it was working with security experts to decrypt the data.
  • Spain’s largest radio station Cadena SER and an NTT DATA company Everis were hit by ransomware attacks. SER is said to be impacted by an unknown ransomware strain that forced the radio station to disconnect all its systems from the internet. Security experts believe that Everis’ data was encrypted by the BitPaymer ransomware.
  • Facebook disclosed that around 100 partners may have accessed user information such as names and profile pictures of members in certain Facebook groups. The social media giant said that although there was no evidence of access abuse, the partners have been asked to delete retained member data. An audit is also said to be conducted to confirm the deletion of data.
  • Cybersecurity firm Trend Micro disclosed a security incident involving a malicious insider threat. Names, email addresses, support ticket numbers, and some telephone numbers may have been compromised due to this incident. A Trend Micro spokesperson reportedly said that around 70,000 customers have been impacted.
  • The U.K. Labour Party was hit by two cyberattacks in 24 hours. Both of the attacks are said to be distributed denial-of-service (DDoS) attacks and the party said that no data breach occurred. It is not clear if the same hackers were behind both attacks.
  • A misconfigured AWS S3 storage bucket exposed around 93,000 files with patient information of three drug and alcohol addiction facilities managed by California-based Sunshine Behavioral Health. The exposed data includes names, physical and email addresses, dates of birth, phone numbers, CVV codes, payment card numbers, and health insurance information. The database has been made private now.
  • Department store chain Macy’s disclosed the details of a data breach involving malicious scripts that stole customers’ payment information. The website was reportedly hacked on October 7, 2019, and the malicious script was injected into the 'Checkout' and 'My Wallet' pages. Macy’s said that only a small number of customers were impacted by this breach.
  • The state of Louisiana suffered a ransomware attack impacting websites and IT systems. As a response to the attack, the state’s cybersecurity team was activated. The extent of damage to the government’s internal system caused by this cyberattack is not clear yet.
  • Facebook and Twitter announced that hundreds of Android users may have had their data improperly accessed after the accounts were used to log in to Google Play Store apps. This reportedly happened because One Audience, a software development kit, allowed third-party developers to access users’ personal data. Twitter said that it had notified Apple and Google of the vulnerability.

New Threats

A number of malware and vulnerabilities were reported in the past month. The infamous Nemty ransomware was observed to be delivered by the Trik botnet. The Emotet Trojan was spotted in a new wave of attacks. Meanwhile, a new phishing campaign targeting Office 365 administrators was reported.

  • Researchers observed that the Nemty ransomware is being delivered by the Trik botnet, which has expanded its reach. The Nemty ransomware is spread to systems with exposed Server Message Block (SMB) network communication protocol. The malware has been observed to be in continuous development since its first appearance in August 2019.
  • The infamous Emotet Trojan has been observed in a new wave of attacks. Researchers noted that the malware had undergone changes in functionality and deployment. The malware authors had used a new list of words to create process names.
  • Security experts have spotted a new phishing campaign targeting Office 365 administrators. The campaign was found using legitimate sender domains to bypass reputation filters. This campaign was found to be targeting admins across several industries and enterprises.
  • A new attack technique that can exploit the ‘Light Commands’ vulnerability to hack smart voice assistants has been discovered. The vulnerability is a design flaw in the micro-electromechanical systems (MEMS) microphones that convert voice commands into electrical signals. Attackers can leverage this vulnerability to perform malicious activities.
  • Researchers disclosed a vulnerability in Amazon Ring doorbells that exposed the passwords of connected Wi-Fi networks. This vulnerability can be exploited by malicious actors to launch massive attacks. Amazon has fixed this vulnerability in all Ring devices.
  • A new version of the ZombieLoad side-channel attack impacting Intel processors was reported. Tracked as CVE-2019-11135, the ZombieLoad v2 exploits the Transactional Synchronization Extensions (TSX) Asynchronous Abort operation in Intel processors. Intel has rolled out patches and vendors have started issuing guidance for customers.
  • The infamous TrickBot Trojan was spotted in a new spear-phishing campaign. The campaign sends fake sexual harassment complaints that appear to be from the U.S. Equal Employment Opportunity Commission. The threat actors are said to be using names, company names, job titles, and phone numbers of victims in the email to make it appear legitimate.
  • The Australian Cyber Security Centre (ACSC) has warned businesses and netizens of Emotet and BlueKeep attacks. Tracked as CVE-2019-0708, BlueKeep vulnerability affects older Windows OS versions including Windows Vista, Windows 7, Windows XP, Server 2003, and Server 2008, said the ACSC advisory.
  • Researchers discovered 19 flaws in VoIP adapters from Cisco's SPA100 Series. These flaws potentially allowed malicious actors to eavesdrop on user conversations, infiltrate into the internal network, and initiate fake phone calls. Cisco has issued patches for these vulnerabilities along with their new firmware release.
  • A camera security vulnerability on Google and Samsung devices was found impacting millions of devices. Tracked as CVE-2019-2234, this flaw allows cybercriminals to hijack the phone and take pictures or record videos even on locked devices. Both Google and Samsung have released patches for this issue.
  • Thousands of Android applications were said to be impacted because of a recently disclosed GIF processing vulnerability. Tracked as CVE-2019-11932, this is a stack buffer overflow bug that could be exploited using MP4 video files. This flaw was initially discovered in Whatsapp and has been patched by its parent company Facebook.
  • The Common Weakness Enumeration (CWE) list outlining the 25 most dangerous software vulnerabilities has been updated for the first time in eight years. The updates were made using a data-driven approach based on reported real-world vulnerabilities. The list has been compiled from the publicly reported vulnerabilities available in the National Vulnerabilities Database (NVD).

Related Threat Briefings

Jul 1, 2025

Cyware Monthly Threat Intelligence, June 2025

Jun 1, 2025

Cyware Monthly Threat Intelligence, May 2025

May 1, 2025

Cyware Monthly Threat Intelligence, April 2025

Apr 2, 2025

Cyware Monthly Threat Intelligence, March 2025

ETSI has rolled out a new quantum-safe encryption standard featuring Covercrypt, a novel key encapsulation scheme with built-in access controls. By tying decryption permissions to user attributes, Covercrypt delivers speed and post-quantum security. The code caves of GitHub got a cleanup crew courtesy of Microsoft. A sprawling malvertising campaign that snagged nearly a million devices worldwide has been knocked down a peg. The race to outpace quantum threats is officially on. The NCSC has issued guidance to help organizations transition to post-quantum cryptography by 2035, with a focus on NIST-approved algorithms and planned support for critical sectors.  A fresh face in the cybercrime underworld is juggling a bag of nasty surprises. EncryptHub is hitting users of QQ Talk, WeChat, Google Meet, and more with trojanized apps and slick multi-stage attacks. Lucid isn’t just phishing - it’s engineering trust through your inbox. This advanced PhaaS platform weaponizes the built-in features of iMessage and RCS to create hyper-realistic scams. A botnet is turning home routers into attack platforms. The Ballista botnet is exploiting an unpatched TP-Link Archer router flaw (CVE-2023-1389) to spread stealthily, using Tor domains and remote command execution to launch DDoS attacks worldwide.

Mar 4, 2025

Cyware Monthly Threat Intelligence, February 2025

Google ramped up its defenses against the quantum threat. The company rolled out quantum-resistant digital signatures in Cloud KMS, following NIST’s post-quantum cryptography standards. Cyber defenders sharpened their tools, this month, and EARLYCROW is the latest weapon against stealthy APT operations. This method detects C2 activity over HTTP(S) using a novel traffic analysis format called PAIRFLOW. PyPI adopted a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. China’s Salt Typhoon made itself right at home in global telecom networks. The group was caught using JumbledPath, a custom-built spying tool, to infiltrate ISPs in the U.S., Italy, South Africa, and Thailand. Russia’s Sandworm hackers are using pirated software as bait. Their latest attack on Ukrainian Windows users disguises malware inside trojanized KMS activators and fake Windows updates. The CISA flagged major security holes in Microsoft Outlook and Sophos XG Firewall. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. A new payment card skimming campaign turned Stripe’s old API into a weapon. Hackers inserted malicious scripts into checkout pages, validating stolen card details through Stripe before exfiltration. A new malware named Ratatouille is stirring up trouble by bypassing UAC and using I2P for anonymous communications. Spreading through phishing emails and fake CAPTCHA pages, it tricks victims into running an embedded PowerShell script. A new version of ValleyRAT was also spotted, using stealthy techniques to infiltrate systems. Researchers found the malware being spread through fake Chrome downloads.

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.

Sep 30, 2024

Cyware Monthly Threat Intelligence

The Good The government took significant steps to strengthen cybersecurity resilience across various sectors. The DHS allocated $279.9 million in grants for the FY 2024 State and Local Cybersecurity Grant Program (SLCGP) to help state, local, and t

Sep 2, 2024

Cyware Monthly Threat Intelligence

The Good In a series of proactive measures aimed at bolstering global cybersecurity resilience, significant strides were made in the education and law enforcement sectors to safeguard critical systems against evolving threats. The NASA Katherine Jo

Aug 1, 2024

Cyware Monthly Threat Intelligence

The Good The collaborative efforts and enhanced protocols by different government bodies represent significant steps forward in strengthening cybersecurity on a global scale. French authorities, in collaboration with Europol, have launched a "disin

Jul 1, 2024

Cyware Monthly Threat Intelligence

The Good Recent developments showcase a proactive stance in bolstering cybersecurity across critical sectors. The collaboration between the U.K’s National Crime Agency (NCA) and the FBI to dismantle the Qilin ransomware gang highlights internationa