Cyware Weekly Threat Intelligence - December 05–09

Weekly Threat Briefing • December 9, 2022
Weekly Threat Briefing • December 9, 2022
With the myriad of cyberattacks coming to light every day, federal authorities are always on their toes to help organizations improve their defensive approaches. In that vein, the GAO has asked the Energy and Transportation departments to assess and patch the risks associated with IoT and OT systems in an attempt to boost critical infrastructure protection. Meanwhile, the Mobile Health App Interactive Tool has been updated by the FTC and the HHS to improve the data security of patients.
The education sector remains an active target of ransomware attacks. Different reports discovered a barrage of attacks by Vice Society and Hive ransomware actors against K-12 schools and higher educational institutions across the globe. The cryptocurrency industry was the target of multiple hacking attacks launched by DEV-0139 and the Lazarus group. While DEV-0139 leveraged Telegram chats as a part of the infection chain process, Lazarus used fake cryptocurrency apps to target users.
User data in smartphones and mobile devices are at risk more than ever. A new dark web marketplace called InTheBox has surfaced online, offering threat actors over 400 custom webinjects to pilfer information from banking, crypto, and e-commerce apps. A sophisticated service dubbed Zombinder has also been spotted on the darknet, helping implant different malware families on Android and Windows systems. In other news, a Golang botnet has emerged in the threat landscape, targeting flaws in Zyxel firewalls, TOTOLINK routers, F5 BIG-IP, Spring Framework, D-Link DNS-320 NAS, and Hikvision cameras.