Cyware Weekly Cyber Threat Intelligence April 23- 27, 2018

Weekly Threat Briefing • Apr 27, 2018
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Apr 27, 2018
The week witnessed some high points in cybersecurity with government agencies and firms making good strides towards addressing cyber threats. The Europol succeeded in dismantling the ‘Webstresser’ which it claimed to be a hotspot for the sale of DDoS attacks. Microsoft has launched 'Windows Defender System Guard' to mitigate attacks in software. On the other hand, researchers at New Zealand have invented the first ever quantum blockchain.
Europol has successfully dismantled the Webstresser website. As per claims by the police, the website sold Distributed Denial of Service (DDoS) attacks and helped launch up to 6 million of them for as many as 136,000 registered users. The investigation was led by the Dutch National High Tech Crime Unit and the UK National Crime Agency (NCA), and assisted by Europol. Four alleged administrators of the site were arrested, the site was shut down and its infrastructure was seized.
A new Windows platform security technology, meant to mitigate attacks in software, has been released by Microsoft. The company announced Windows Defender System Guard runtime attestation that can provide signals for Endpoint Detection and Response (EDR) and antivirus vendors. The security technology is also capable of detecting kernel tampering, rootkits, and exploits.
A study by researchers in New Zealand found out that the newly proposed quantum blockchain can result in blockchain systems that are unaffected by quantum-computer hacking. This is considered to be the first ever fully quantum blockchain. This new quantum blockchain functions by interpreting its mistakes and influencing its own past.
Along with the favorable news, the week noticed some disappointing breaches and attacks. While Dubai-based ‘Careem’ app was affected by a data breach which resulted in data theft of 14 million users; ‘MyEtherWallet’, a web-based Ether wallet service suffered from the loss of cryptocurrencies due to DNS hijack. An unsecured Mongo database led to the data leak of 25,000 Bezop’s investors and 2 million UK bank customer faced trouble due to a faulty IT upgrade.
Dubai-based ride sharing platform Careem became a victim of data breach after a cyber attack resulted in the theft of personal data of up to 14 million people in the Middle East, North Africa, Pakistan and Turkey. The company announced that the breach was detected on January 14, post which, a thorough investigation was launched and leading security experts were engaged to strengthen security systems.
The DNS server of MyEtherWallet, a web-based Ether wallet service, was hijacked by unknown hackers in order to redirect users to a fake version of the website and steal their wallet private keys. Using these keys, hackers managed to steal close to 215 Ether (about $160,000 at the time of the transaction). Hackers could hijack the DNS entries by executing a BGP route hijack that redirected traffic meant for Amazon servers to systems they controlled.
Hackers managed to redirect Amazon traffic to rogue destinations for two hours by exploiting the Internet-protocol weakness. Roughly 1,300 IP addresses were hijacked in this charade. Attackers also masqueraded as cryptocurrency website MyEtherWallet.com and stole about $150,000.
Around 25,000 investors and potential investors linked with Bezop.io, the organization behind the Bezop cryptocurrency, had their personal details leaked due to an unsecured Mongo database. The personal information included names, addresses, encrypted passwords, wallet information, scanned passports, and copies of driver’s license. Bezop immediately secured the data after being notified.
Around two million UK banking customers experienced trouble using their accounts after an IT upgrade went wrong. Customers were also able to access other users’ savings and business accounts. The Financial Conduct Authority (FCA) and the Information Commissioner’s Office(ICO) are said to be investigating the incident.
Talking about threats, researchers found Operation GhostSecret targeting global facilities and Rubella Macro Builder crimeware kit being used for campaign attacks. In other news, researchers unearthed Crossrider Variant and a new botnet family known as SquirtDanger was discovered.