Cyware Weekly Threat Intelligence - December 06–10

Weekly Threat Briefing • December 10, 2021
Weekly Threat Briefing • December 10, 2021
The Good
While cybercriminals continue to innovate their tactics, researchers are no behind in taking them over. Glupteba, the blockchain-enabled, modular botnet was torn down by Google’s TAG team. In the same line, Microsoft confiscated 42 domains by Nickel, a prolific China-based cyberespionage gang. The group was active across several countries. Sigh of relief
Google’s TAG dismantled the Glupteba botnet, which compromised around 1 million Windows and IoT devices. The blockchain-enabled botnet grows at the pace of thousands of new devices every day and propagates via malicious documents, fake YouTube videos, fake pirate software, and traffic distribution systems, among others. TAG terminated 63 million Google docs, 1,313 Google accounts, 908 cloud projects, and 870 Google Ads accounts.
Microsoft seized 42 domains used by Chinese cyberespionage group Nickel, aka APT15. The actors were involved in harvesting intelligence on foreign ministries, human rights organizations, and think tanks. Nickel was active in the U.S., Argentina, Chile, Barbados, Bosnia, Brazil, Herzegovina, Ecuador, and the Czech Republic, among several other nations.
Iowa State University joined hands with the University of Illinois to lead a coalition of industry and government partners to develop cybersecurity talent in the Midwestern U.S. Dubbed ReCIPE, the coalition has received a two-year grant funding of $2 million from the NSA.
The Justice Department and FBI indicted a Canadian national for his supposed involvement in multiple ransomware attacks. Named Matthew Philbert, the perpetrator was arrested on counts of conspiracy to commit fraud and related activity associated with computers. However, officials have not revealed which ransomware gang the cybercriminal belonged to.
The U.K and Singapore finalized negotiations on a digital economy agreement that emphasizes digital trade, cybersecurity, and data flow. The pact necessitates both countries to implement interoperable systems for digital payments and identities and secure data flow.
The CISA’s new Binding Operational Directive (BOD) necessitated federal agencies to patch almost 300 known vulnerabilities. The directive is applicable for all hardware and software on both internet- and non-internet-facing systems. The BOD establishes that agencies have two weeks to close bugs disclosed this year and six months for older ones, some even dating back to 2014.
The Bad
We are afraid to inform you that this week witnessed several data leaks due to unsecured databases and web servers. While a French transportation company blurted out the data of almost 60,000 employees, a Florida-based healthcare tech company revealed the details of 30,000 U.S. healthcare workers. Cryptocurrency exchange platforms are still under attack with Bitmart being the latest victim.
New Threats
The cybersecurity world was at peace when Emotet was taken down, however, since its return, Emotet has become a massive cause of pain in the neck. While we are on the topic of malware, a new cryptominer has reared its head and is targeting QNAP NAS devices. In other news, phishing campaigns have started using Omicron-themed lures to target students in dozens of universities across the U.S.