Cyware Weekly Threat Intelligence, April 20 - 24, 2020

Weekly Threat Briefing • Apr 24, 2020
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Apr 24, 2020
The Good
While the whole world continues to fight against the COVID-19 outbreak, here’s some good news from cyberspace to cheer you up. Researchers have successfully disrupted the operations of the notorious VictoryGate botnet that was primarily used by cybercriminals to mine Monero cryptocurrency. The botnet had infected more than 35,000 computers worldwide. On the other hand, the US Department of Justice (DoJ) has notified that hundreds of online domains related to COVID-19 scams were disrupted in an ongoing joint effort between law enforcement agencies and private companies.
ESET researchers disrupted the operation of VictoryGate botnet by taking down more than 35,000 infected computers. The botnet that enabled its attackers to mine Monero cryptocurrency, had more than 90% of the total victims in Peru.
The National Cyber Security Center (NCSC) along with other government departments successfully took down more than 2,000 online scams related to coronavirus in the last month. This crackdown is a part of a ‘Suspicious email reporting service’ program that aims to protect people from fraudsters and phishing scams.
The US Department of Justice (DoJ) announced the takedown of hundreds of online domains related to COVID-19 scams, in a joint effort with law enforcement agencies, and a number of private sector companies. These domains were registered by cybercriminals to commit fraud and other crimes.
The National Security Agency (NSA) and Australian Signals Directorate have jointly released an advisory for mitigating web shell malware. The advisory includes a detailed description of the attack process and mitigation techniques.
The Bad
Talking about the bad, Cognizant made headlines this week for being attacked by Maze ransomware operators. Just like the previous weeks, there were also reports of credentials and personal data dumping on dark web forums. These credentials belonged to users of Facebook, Webkinz World, and the Aptoide app.
Cognizant confirmed that it was hit by the Maze ransomware last weekend. The attack had caused disruption for some of its clients.
Personal information of 267 million active Facebook users was put up on the dark web for a mere price of $600. Most of these records belonged to users in the United States and included Facebook profiles, full names, unique IDs for each account, timestamps, and more.
The credentials of over 23 million Webkinz World players also made their way to the dark web after a hacker breached a database using an SQL injection vulnerability.
Two cryptocurrency firms - Lendf.Me and Uniswap - suffered a major loss after hackers stole $25 million worth of cryptocurrencies. The hackers used the reentrancy attack to siphon funds from each platform into their wallet. After some days of attack, the stolen amount was returned back to the firms by the attackers.
Cybercriminals breached the database of the Aptoide app to steal 39 million customer records. Out of these, 20 million customer details, including login emails and hashed passwords, were published on a popular hacker forum.
An unsecured database belonging to Kinomap leaked 42 million records including PII. The records belonged to users across the globe, including North America, Australia, Japan, the UK, and several European countries.
Unknown activists posted nearly 25,000 email addresses and passwords belonging to the National Institutes of Health (NIH), World Health Organization (WHO), Gates Foundation, and other groups working to combat the coronavirus pandemic. The lists were posted on 4chan, Pastebin, Twitter, and Telegram.
Beaumont Health notified about 114,000 patients that their personal data was breached in a phishing attack in 2019. The attackers had hacked several email accounts to access health and contact information.
DoppelPaymer leaked confidential data belonging to the City of Torrance on its ‘Dopple Leaks’ website. The data included the city’s budget financials, various accounting documents, document scans, and an archive of documents belonging to the City Manager. In a different incident, SeaChange, a leading supplier of video delivery software solutions, became the latest victim of the Sodinokibi ransomware.
An error in the official website of the U.S. Small Business Administration (SBA) had leaked personal information linked to 7900 businesses to other applicants that had applied for COVID-19 relief funds. This leaked data included Social Security numbers, income accounts, names, addresses, and contact information.
An unsecured database belonging to Paay had exposed about 2.5 million transaction records online. These records were left open to the public for three weeks before it was secured.
Data of around 3000 employees working with UniCredit S.p.A went on sale on the dark web on April 19. The attacker who sold the data claimed to have compromised UniCredit’s systems and exfiltrated the data. The compromised information included names, email addresses, phone numbers, and encrypted passwords.
New threats
Among the new threats discovered, FPGA chips were found to be affected by two flaws that could expose several critical systems to attack. One of these flaws is a new Starbleed vulnerability that affects Xilinx FPGA chips. Meanwhile, researchers also uncovered that a dozen state-backed hacking groups are using COVID-19 themes as a lure to target US government employees and healthcare organizations.