Cyware Weekly Cyber Threat Intelligence April 16 - 20, 2018

Weekly Threat Briefing • Apr 20, 2018
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Apr 20, 2018
Government agencies and cybersecurity companies made strides this week towards addressing cyber threats. The US Energy Department is looking to fund research towards bolstering the country’s critical infrastructure against cyberthreats. Over 30 companies pledged to not help governments launch cyberattacks. Experts have also developed an algorithm to detect fake users on social media while IBM launched an open-source library to secure AI systems.
The US Department of Energy announced $25 million in grants for projects that can strengthen the cyberdefenses of the nation’s critical energy infrastructure, including its power grid, oil, and natural gas industry. The announcement comes just weeks after cyberattacks crippled electronic communications systems for several US pipeline companies.
Facebook, Microsoft, Oracle and 31 other technology companies signed the Cybersecurity Tech Accord this week pledging to defend all customers and products from cyberattacks. They also took a “no offense” commitment to not help governments launch cyberattacks and protect their services against tampering and exploitation at every stage, from development to distribution.
Researchers at Ben-Gurion University of the Negev and the University of Washington have developed a new algorithm to detect fake users on social media platforms, including Facebook and Twitter, based on the assumption that fake accounts typically establish unlikely links to other users. The algorithm features two machine learning-based iterations - one to estimate the probability of a link existing between two users and the second to generate meta-features used to construct a generic classifier to detect fake profiles.
At the RSA Conference in San Francisco, IBM unveiled the Adversarial Robustness Toolbox - an open-source security library designed to help support developers and users fight against cyberattacks that target AI systems. Featuring a library, interfaces, and metrics, the toolbox will help developers create and deploy practical cybersecurity defense systems for the AI sector.
This week saw another slew of data breaches. TrueMove H leaked customer data via an exposed AWS S3 bucket. Texas Health Resources said an unauthorized party accessed patient data following an email compromise. The US and UK accused Russia of ramping up cyberattacks on American and British companies and government agencies. TaskRabbit temporarily took down its website following a “cybersecurity incident”.
TrueMove H, one of Thailand’s biggest mobile operators, suffered a data leak compromising the data of at least 11,400 customers. Customers’ personal data, which included scanned images of ID cards, was exposed in an unprotected Amazon Web Services S3 cloud storage bucket. The company said the leak was fixed on April 12, but the incident has already triggered scrutiny and backlash from regulators and customers.
Texas Health Resources disclosed that an unauthorized third party may have accessed patient data back in October 2017 after compromising some of the organization’s email accounts. Compromised data included patient names, addresses, medical record numbers, dates of birth, insurance and clinical data. The firm reportedly said less than 4000 patients were impacted.
The US Department of Homeland Security, Federal Bureau of Investigation and the UK’s National Cyber Security Centre issued a rare joint statement accusing Russian state-sponsored hackers of penetrating network infrastructure devices such as routers within government, private companies, critical infrastructure, and ISPs. The agencies accused Russia of using compromised routers to conduct espionage, extract intellectual property and maintain persistence to possibly conduct larger offensive attacks in the future. The Kremlin has dismissed the allegations as “unsubstantiated” and of “no value.”
Handyman-for-hire app, TaskRabbit revealed it suffered an apparent data breach saying an “unauthorized user” managed to gain access to its systems and compromised certain personally identifiable information. The company briefly took down its website and app to safeguard its users. Users have been advised to change their passwords and monitor their accounts for any suspicious activity.
Localbox, a little-known data firm that builds personal profiles by scraping data from public sites and social media networks like Facebook, Twitter and Zillow without users knowledge or consent, accidentally leaked a trove of personal data. UpGuard’s Chris Vickery found the firm left a cache of profile data on an unprotected Amazon S3 storage bucket that listed 48 million individual records.
Researchers uncovered new strains of malware including the Roaming Mantis that leverages DNS hijacking to infect Android smartphones. The ViperRat malware and Desert Scorpion spyware were found lurking on Google Play Store. A Nigerian BEC group has been targeting the shipping industry via email compromise and phishing techniques.