Cyware Weekly Threat Intelligence, April 06 - April 10, 2020

Weekly Threat Briefing • Apr 10, 2020
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Apr 10, 2020
The Good
As the COVID-19 pandemic has forced a massive adoption of remote working, numerous organizations now need to secure their extended threat environment. To aid organizations in this transition, Microsoft this week released new security guidance detailing the various attack vectors and tactics used by threat actors to leverage the pandemic to target employees working from home. On the other hand, the Canadian Internet Registration Authority (CIRA) launched a country-wide Domain Name System (DNS) filtering service to protect critical infrastructure and organizations from malware and phishing threats.
Microsoft published new threat intel and security guidance for individuals and organizations in the wake of rising incidents of phishing and social engineering attacks that have hit every country during the coronavirus pandemic.
Canadian Internet Registration Authority (CIRA) launched a country-wide DNS filtering service to block malware and phishing threats, with early access given to healthcare workers, small businesses, and educational institutions.
The Commonwealth Scientific and Industrial Research Organisation (CSIRO), an Australian federal agency, announced the creation of the seL4 Foundation, a not-for-profit organization, to accelerate the development of the seL4 microkernel and related technologies. The seL4 project is designed to be the world’s first operating system (OS) kernel that is mathematically proved secure.
Google released a free software security book, titled 'Building Secure and Reliable Systems', that provides first-hand lessons in avoiding and responding to failures caused by attackers or small internal changes. The book provides valuable insights into how security teams can improve their site reliability engineering (SRE) practices.
Nominet, a UK-based domain name registrar, blocked 600 coronavirus-themed websites that were found scamming the public by selling fake vaccines, protective equipment, and fraud remedies.
The Bad
The week saw a number of significant data leaks and other noteworthy incidents. The email marketing firm, Maropost, exposed an unsecured database containing 95 million records with information on its numerous clients. Meanwhile, researchers also reported a massive BGP hijacking attack by the Russian state-owned telecom provider that redirected the web traffic of more than 200 Content Delivery Networks (CDNs) and cloud hosting providers. The affected companies included the likes of Google, Amazon, Facebook, Akamai, and Cloudflare.
An unsecured database owned by the email delivery and marketing firm, Maropost, exposed about 95 million email records and email logs. The leaked email logs contained relevant metadata, such as the exact date and time the emails were sent. The database, which is hosted on the Google cloud server, was taken offline on April 1, 2020.
Bisq Bitcoin exchange temporarily disabled trading after the discovery of a critical vulnerability in its platform. The firm plans to release v1.3.0 soon to fix the issue. Until then, users are asked not to send any funds to and from Bisq.
Hammersmith Medicines Research Ltd. (HMR) suffered an attack from Maze ransomware. The incident had occurred on March 14, 2020, following which the ransomware operators had stolen the data hosted on HMR’s network. The attackers had eventually released the data on their ‘News’ site on March 21 when the research company denied paying the ransom. The stolen records contained the personal information for volunteers whose surnames began with D, G, I, J.
Researchers at Microsoft noted that cybercriminals have adopted COVID-19 phishing lures to target individuals and organizations across 241 nations and territories. The tech giant also detected a massive campaign using 2,300 different webpages attached to phishing emails disguised as COVID-19 financial compensation information. The spoofed pages were designed to capture users’ Office 365 credentials.
The data of more than 600,000 Email.it users was put up for sale on the dark web forum. The incident came to light on April 5, 2020, when the hackers - going by the name of NN - went on Twitter to promote a website that was used to sell the company’s data. They claimed that the actual intrusion took place more than two years ago, in January 2018. The selling price of the data varies between 0.5 and 3 bitcoin.
Berkine, a subsidiary of a US-based firm, previously known as Anadarko Petroleum Corp., was hit by the Maze ransomware. The attackers have managed to steal an entire database containing over 500 MB of confidential documents related to budgets, organizational strategies, and production quantities.
The traffic of more than 200 Content Delivery Networks (CDNs) and cloud hosting providers, was redirected by Rostelecom in a BGP hijacking attack last week. The attack lasted for about an hour and affected over 8,800 internet traffic routes. The impacted companies included Google, Amazon, Facebook, Akamai, Cloudflare, GoDaddy, Hetzner, and Linode.
The US Small Business Administration (SBA) revealed that the personally identifiable information (PII) for some of the financial relief loan applicants may have been exposed to other applicants online. The incident occurred due to a security flaw in the loan application site. The issue was immediately resolved and the application portal was relaunched to avoid exposure of sensitive data.
Microsoft shared details of an Emotet attack on an organization named Fabrikam (a placeholder name given by Microsoft in its case study). The attack relied on a phishing message that was opened by an internal employee. This unleashed the malware, which later infected the organization’s systems and halted core services by saturating the CPU usage on Windows devices.
A new attack campaign linked to the DarkHotel APT group targeted more than 200 Sangfor SSL VPN servers by exploiting a zero-day vulnerability. 174 of these servers were located on the networks of government agencies in Beijing and Shanghai, and the networks of Chinese diplomatic missions operating abroad. This included countries like Italy, Pakistan, Indonesia, Thailand, the UAE, Israel, Malaysia, Iran, Ethiopia, and India.
The personal information of around 45,000 Iranian individuals, totaling to 8.17 GB, was put up for sale on the dark web for an amount of $200 in BTC. The stolen data appeared to have come from several sites including Niazpardaz[.]ir, an online advertising platform, and Arzi24[.]com, a website owned by Farhad Exchange. Security researchers also found another trove of leaked data for sale, including 52,000 ID cards along with selfies of their respective owners.
IBM X-Force researchers discovered a SMiShing campaign designed to unlock the phone for resale on the black market. The phishing campaign was found to be operating over 600 phishing domains designed to steal iCloud credentials from Apple users. The attackers behind the campaign were found focusing on cybersecurity and tech conferences to steal iPhones belonging to influential company executives, only to later target them with the SMShing campaign to extract their credentials and private data.
Two school districts in the US state of California suffered cybersecurity breaches due to security issues plaguing the video conferencing platform, Zoom. In one incident, the school administrators mistakenly posted hundreds of meeting access codes and passwords on a publicly accessible webpage.
In an internal memo sent to all its personnel, NASA warned of an exponential increase in malware attacks and a doubling of targeted phishing attacks as employees started working from home during the COVID-19 pandemic.
Security researchers at BlackBerry reported that state-linked Chinese APT groups have targeted US firms for over a decade to steal intellectual property and other sensitive business data. The hackers especially targeted the Linux-based backend servers as they lacked adequate security compared to other key infrastructure.
New Threats
Despite a lockdown across many countries, hackers continue to evolve their malicious exploits and attack techniques. This week, researchers came across two new advanced botnets, namely Dark Nexus and DDG. While Dark Nexus is capable of performing DDoS attacks on various IoT devices, DDG is a sophisticated cryptomining botnet that is capable of functioning independently of its C2 servers, using its proprietary P2P protocol. A new ‘Mouse-Over’ attack technique affecting Microsoft PowerPoint was also discovered this week. The technique can allow attackers to bypass security restrictions and manipulate user files on targeted devices.