Cyware Monthly Threat Intelligence

Monthly Threat Briefing • Oct 3, 2022
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Monthly Threat Briefing • Oct 3, 2022
Governments worldwide continue to ramp up security measures across Internet of Things (IoT) products. The European Union, last month, outlined new cyber regulations regarding IoT products. Under the new rule, the European Commission will have the power to recall and ban non-compliant cyber products and services. Along the same lines, the NSA becomes the latest U.S. federal agency to kick off its digital migration to quantum-resistant networks; sets 2035 as the deadline.
The European Union started working on a set of new cybersecurity rules for IoT vendors that are expected to come into effect by 2024. Some of the rules mandate frequent testing of devices for vulnerabilities, encryption of confidential data, and application of security updates regularly. Companies failing to comply with the rules may risk fines of 2.5% of their annual turnover or €15 million (~$15.07 million).
The NSA published requirements for quantum-resistant algorithms that need to be implemented by vendors and operators of national security systems. The process aims to secure the classified information that is critical for military and intelligence activities.
The CISA announced the release of its 2023–2025 strategic plan that aims to focus on reducing risk and building resilience to cyber threats to the nation’s infrastructure. The plan is built on the foundation of CISA Strategic Intent, published in 2019.
The Biden Administration launched a cyber grant program of up to $1 billion for state and local governments to fortify their digital defenses. The program will be administered by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Emergency Management Agency (FEMA).
The FBI has raised an alarm about cyberattacks against healthcare payment processors. Such escalation in attacks has resulted in significant monetary losses to the sector. The DeFi sector continues to serve as a hotbed for cybercriminals as cryptocurrency firm Wintermute reported millions in losses. In another update, NATO documents were dumped on the dark web for sale. It contained hundreds of secrets and confidential documents that were sent to the Portugal government.
The FBI issued an alert about hackers targeting healthcare payment processors to route payments to their bank accounts. This year, threat actors have stolen more than $4.6 million from healthcare companies. In another alert, the agency warned the sector that threat actors are continuing to exploit unpatched and outdated medical devices.
Threat actors were found leveraging hacked Facebook business pages to spread RedLine Stealer. These accounts belonged to a Brazilian ISP, Mexican sporting goods store, a mountain tourism site in Slovakia, and a computer repair shop in the Philippines. The malware is available on dark web forums for about $100 to $150.
Around 20,000 accounts associated with The North Face outdoor apparel brand were compromised in a credential stuffing attack. These accounts included personal information, such as full names, billing addresses, shipping addresses, telephone numbers, and XPLR Pass reward records of users.
Cryptocurrency market maker Wintermute was breached, with attackers stealing $162.5 million worth of cryptocurrency from the company’s DeFi business. The hackers exploited a privileged function with the private key leak to replace a swap contract with their contract. This is the fifth largest cryptocurrency theft, so far, this year.
A hacker claimed to have pilfered 2 billion TikTok records, including 760GB of user data. While security analysts confirmed the breach, the social media platform denied any such incident. Meanwhile, TikTok shot back at reports of the breach.
Researchers at Mandiant and Microsoft have linked a series of cyberespionage attacks targeted against the Albanian government. Microsoft reported four different Iranian APTs—DEV-0842, DEV-0861, DEV0166, and DEV-0133—were involved in these attacks that were believed to be active since 2021.
Lorenz ransomware group exploited a flaw in MiVoice Connect’s Mitel Service Appliance component to gain access to a corporate network. The attackers waited for a month after gaining initial access and then performed lateral movement. They utilized FileZilla for data exfiltration and performed encryption through BitLocker.
Classified NATO documents belonging to the Armed Forces General Staff agency of Portugal (EMGFA) were put on sale on the dark web. The stolen documents were spotted by the U.S. Information Services, after which it alerted the Portuguese authorities by informing the U.S. embassy in Lisbon.
Threat actors exploited an unauthorized access vulnerability to target over 39000 Redis servers to deploy XMRig cryptominer. Most of the vulnerable Redis servers were located in China, followed by Germany and Singapore.
Australia-based telecommunications provider Optus notified that it is dealing with a cyberattack that affected customers’ personal data. The information exposed include names, dates of birth, phone numbers, ID document numbers, and email addresses of customers.
Hive ransomware claimed an attack on the New York Racing Association (NYRA). The attack took place on June 30, and resulted in the exfiltration of customers’ data such as their Social Security Numbers, health records, and health insurance information.
Multiple npm packages published by crypto exchange dYdX, and used by at least 44 cryptocurrency projects, were compromised to run infostealers on systems. The infostealer was used to steal AWS IAM credentials, SSH keys, and GitHub tokens.
DeFi cryptocurrency platform BXH suffered a loss of around $40,000 due to a flash loan attack. This is the second time that the organization was attacked after losing an amount of nearly $2.5 million in a hack that occurred on September 23.
Witchetty emerged as a new hacking group using a steganographic technique to target Middle Eastern governments. Coincidentally, the threat landscape saw another malware threat targeting the Middle East and Africa, dubbed Metador. Meanwhile, the effect of the leaked Lockbit 3.0 builder became visible last month; Bl00dy ransomware group was found using it to target Ukrainian organizations.