Cyware Weekly Threat Intelligence - August 23–27

Weekly Threat Briefing • Aug 27, 2021
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Aug 27, 2021
The Good
Why are ransomware gangs shutting down operations? We aren’t complaining; we’d just like to know why. Anyway, another gang, known as Ragnarok, closed shops and released its master decryptor. Yay! In other news, the U.S. and the U.K are taking positive steps into strengthening their cybersecurity stance.
The FBI released its first-ever public advisory elaborating the behavior of a ransomware affiliate named OnePercent Group, known for its well-structured extortion technique.
The Ragnarok ransomware gang shut down its operations and released a master key for its victims.
The U.K is planning on changing data protection and privacy laws, which are anticipated to promote economic growth and innovation. The data adequacy partnership will enable Britain to trade with countries such as the U.S., the Republic of Korea, Australia, and Singapore.
Post a cybersecurity meeting at the White House, several tech companies, including Microsoft, Google, and Amazon pledged to invest billions to enhance the nation’s cyber resilience.
A U.S. national living in Turkey admitted to being the primary culprit behind the massive T-Mobile hack that affected at least 50 million customers.
The Bad
The week was rife with attacks on healthcare providers, including Eskenazi Health and Atlanta Allergy & Asthma. Talking about cyberattacks, new reports emerged claiming a possible breach at the U.S. State Department this month. Now, imagine your secretive software program allowed unauthorized access to sensitive data because of a glitch. Grim! This is exactly what happened with the Palantir software used by the FBI.
Indiana-based Eskenazi Health disclosed that a ransomware attack pilfered patient data and leaked the stolen information. In the aftermath, its EHR experienced a downtime.
Eye & Retina Surgeons suffered a ransomware attack that impacted clinical data, including clinical notes and eye scans of about 73,500 patients.
A glitch in Palantir—a secretive software program used by the FBI—enabled some employees to gain unauthorized access to confidential data. This went on for more than a year.
A data breach at Chico State University exposed the personal information of 130 students who requested religious exemptions from COVID-19 vaccination.
Users of OpenSea, a peer-to-peer marketplace for NFTs, were targeted in an ongoing Discord phishing attack to steal cryptocurrency funds and NFTs.
The Belgian Police singled out eight Android apps hosting Joker malware. The virus is capable of subscribing the user to payment services without users’ authorization.
Atlanta Allergy & Asthma informed nearly 9,800 patients of a data breach that blurted out their PHI such as SSNs, financial details, and treatment-related information.
Cybercriminals swindled nearly $2.3 million from the employees of the Town of Peterborough, New Hampshire, using spoofed email accounts and forged documents, the Town administrator announced in a press release.
Thousands of web apps laid bare 38 million sensitive records from a number of COVID-19 contact tracing platforms, vaccination sign-ups, job portals, and employee databases.
The U.S. State Department suspected a breach after an unauthorized actor infiltrated its network. It claimed no significant disruption in its daily operations.
New Threats
Discord has become a pretty popular space for cybercriminals because of its varied functionalities. A new malware has recently made Discord its home and used it to deploy multiple malware on targeted systems. This section would be incomplete without the mention of at least one scam. Hurricane-related scams are the latest entrant in the huge wave of scams victimizing people. On a different tangent, South Asian countries are being targeted by a new cyberespionage campaign that has been active for more than a year.