Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Weekly Threat Intelligence, December 09 - 13, 2019

Cyware Weekly Threat Intelligence, December 09 - 13, 2019 - Featured Image

Weekly Threat Briefing Dec 13, 2019

The Good

Ready to kickstart your weekend celebrations? Same here. But before we proceed, let’s quickly glance at positive developments made in cybersecurity this week. Google introduced better password protections and new real-time alert systems for phishing attempts on devices. Also, the U.S. Senate formally approved the legislation to establish a consortium to develop and prepare state and local governments’ cyber readiness program.

  • Google has introduced a new real-time alert system that warns users of phishing attempts. These new protections can inspect the URLs of pages visited with Safe Browsing’s servers in real-time. The additional features include phishing protections and tab freezing to further control tab actions. Google expects that predictive phishing protection will protect hundreds of millions of people.

  • The U.S. Senate has passed legislation to formally charter a National Cybersecurity Preparedness Consortium (NCPC) to foster preparedness among state and local governments and first responders for cyber emergencies. With Norwich as a founding member, the new law will allow DHS and NCPC to work together to develop multi-year plans for improving cyber readiness.

The Bad

Meanwhile, it remained a challenging week for organizations with big hacks and ransomware incidents. Over 2.7 billion email and password combinations were leaked online on an unprotected server. Also, Maze ransomware operators have taken the credit for the attack on leading wire and cable manufacturer Southwire Company. Further, over 752,000 birth applications were left exposed in the U.S due to an unguarded AWS storage bucket.

  • More than 2.7 billion email addresses were left open on the web by an unnamed party. Surprisingly, over a billion of these records contained passwords in plain-text. Many of those leaked email addresses used domains of China’s biggest internet companies such as Tencent, Sina, Sohu, and NetEase. The database owner is yet to be identified.

  • Maze Ransomware operators claimed responsibility for the attack on Southwire Company, LLC (Southwire) from Carrollton, Georgia. The ransomware affected computing systems on a company-wide basis and demanded 850 BTC, which is approximately $6 million in ransom.

  • More than 752,000 applications were compromised when an online company, that allows people in the U.S. to obtain a copy of their birth certificate, left its AWS storage bucket server open. U.K-based Fidus Information Security reported about the exposed data and TechCrunch verified the same by matching names and addresses against public records.

  • Researchers disclosed that more than 455,000 Turkish payment cards were being sold online on the popular Joker's Stash marketplace. After going through the card types and issuing banks, researchers suggested that the data came from a source that handles payments. Authorities are suspecting Magecart attackers (JS skimmers) behind this, also because of the popularity, it has earned recently.

  • Airtel, India’s third-largest telecom network, admitted to an API security flaw in its smartphone app which could have exposed the personal data of more than 300 million users. Potentially exposed information includes name, address, email, date of birth, and network information among others.

  • In Argentina, attackers encrypted 10 years’ worth of government data using a ransomware. Approximately 7,700 GB of data was compromised as a result of the attack. Reports suggested that attackers demanded somewhere between $37,000 and $370,000 (0.5 and 50 BTC) in exchange for decrypting the files. However, the government said that it had recovered 90 percent of data by itself.

  • The details of over 15 million Iranian bank cards were published online after hundreds of bank branches were set on fire last month by demonstrators. Experts suspect a state-sponsored cyberattack and the largest financial scam in Iran’s history. The breach, which mostly targeted Iran’s three largest banks, affected close to one-fifth of the population.

  • STCS, a Saudi Arabian telecom company, was found exposing hundreds of thousands of constantly updated GPS locations on its server. The unknown source reported that the unprotected server contained an instance of Kibana, a piece of software for sorting and visualizing data. The last 15 minutes of rolling data consisted of over 140,000 entries.

  • The networks of BMW and Hyundai car manufacturers were breached by the Ocean Lotus hacker group. The attackers said to have used a penetration testing toolkit called Cobalt Strike as a backdoor to compromise networks.

  • Colorado-based IT provider Complete Technology Solutions fell victim to a ransomware attack that impacted the operations of more than 100 dental practices in the U.S. Experts suggested that the intruders compromised a remote access tool that did not have two-factor authentication (2FA) activated.

New Threats

The week was seemingly full of threats and alerts. A new version of VegaLocker ransomware called Zeppelin was found affecting IT and healthcare services in the U.S. Canada, and Europe. In other news, a cyberespionage group returned with new evasion techniques only to target technology companies and government agencies in East Asia. Also, there was a critical flaw reported to be existing in Intel CPUs that use SGX, a solution designed to protect data in the private regions of memory.

  • Zeppelin ransomware, a new variant of VegaLocker, has been spotted infecting the U.S. Canada, and European tech and healthcare companies via targeted attacks. It is not known how the ransomware is being distributed, but it is likely through Remote Desktop servers that are publicly exposed to the internet.
  • Waterbear campaign, associated with the cyberespionage group BlackTech, returned with new evasion techniques. Researchers found that the bad actors are now using API hooking techniques to avoid being detected by a specific security product. The campaign uses two different APIs, namely ‘ZwOpenProcess’ and ‘GetExtendedTcpTable’ to hide its specific processes. The campaign mainly targets technology companies and government agencies in East Asia.
  • Intel CPUs were discovered with a critical ‘Plundervolt’ flaw that directly breaches SGX’s integrity guarantees. The flaw exploits a dynamic voltage scaling feature that CPUs already have, and that can be triggered from software through a special Model Specific Register (MSR). Here, attackers could extract sensitive data, including full RSA encryption keys.
  • A new malware campaign targeting iPhone users, dubbed Krampus-3PC, impacted more than 100 publisher websites including online newspapers and international weekly news magazines. The web redirect campaign masqueraded as a grocery store reward ad. Along the way, the malware proceeds to harvest users’ sessions and cookie information, thus giving attackers the ability to log into the victim’s various online accounts.
  • Hundreds of fraudulent sites selling fake branded shoes were found to be infected with web skimmer malware. This not only disappointed the shoppers with faux merchandise but could also result in the loss of personal and financial data to Magecart fraudsters. Researchers noted that all had one thing in common: they were running outdated versions of Magento and PHP.
  • The Gamaredon hacking group is said to be targeting Ukranian officials since October 2019. The group, that has a history of targeting individuals associated with the Ukranian government, used weaponized documents with malicious code as the initial infection vector in this campaign. According to security researchers, this campaign is still ongoing.
  • A group of attackers was found using Microsoft Office 365 OAuth apps to hijack recipients’ accounts and their data. The attack involved recipients receiving phishing emails that pretend to be shared OneDrive or SharePoint files that contain a malicious link to the shared document. Attackers could gain access to a user's OneNote notebooks, stored files, and the ability to read their email and contacts.
  • Google has fixed a critical security flaw that could potentially be exploited by sending a specially crafted message, resulting in permanent denial of service (DoS) in Android. It also fixed other high severity flaws including a remote code execution, an elevation of privilege, and five information disclosure weaknesses. Overall, over 40 vulnerabilities were addressed by the tech giant.
  • Apple has addressed a bug found in AirDrop in iOS version 13.3. The bug allowed users to share files repeatedly between iOS devices that are within the wireless range while temporarily locking users out of their iPhones and iPads. The issue was mitigated by adding a rate-limit that prevents a barrage of requests over a short period of time.
  • NVIDIA has released security updates for six high severity vulnerabilities impacting chips used in various devices such as Mercedes infotainment system, Mercedes Infotainment System, and Android tablets. The flaws are said to potentially provide attackers with a number of privileges to trigger denial-of-service (DoS) states, execute arbitrary code, escalate privileges, and launch information disclosure attacks.

Related Threat Briefings

Feb 7, 2025

Cyware Weekly Threat Intelligence, February 03–07, 2025

PyPI is taking a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. The U.K is bringing earthquake-style metrics to cybersecurity with its new Cyber Monitoring Centre, designed to track digital disasters as precisely as natural ones. Inspired by the Richter scale, the CMC will quantify cyber incidents based on financial impact and affected users, offering clearer insights for national security planning. Kimsuky is back with another phishing trick, this time using fake Office and PDF files to sneak forceCopy malware onto victims' systems. Its latest campaign delivers PEBBLEDASH and RDP Wrapper by disguising malware as harmless shortcuts, ultimately hijacking browser credentials and sensitive data. Hackers have found a new way to skim credit card data - by hiding malware inside Google Tag Manager scripts. CISA is flagging major security holes in Microsoft Outlook and Sophos XG Firewall, urging agencies to patch them before February 27. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. Bitcoin scammers are switching tactics, swapping static images for video attachments in MMS to make their schemes more convincing. A recent case involved a tiny .3gp video luring victims into WhatsApp groups where scammers apply pressure to extract money or personal data. XE Group has shifted from credit card skimming to zero-day exploitation, now targeting manufacturing and distribution companies. A new version of ValleyRAT is making the rounds, using stealthy techniques to infiltrate systems. Morphisec found the malware being spread through fake Chrome downloads from a fraudulent Chinese telecom site.

Jan 10, 2025

Cyware Weekly Threat Intelligence, January 06–10, 2025

The U.K is fortifying its digital defenses with the launch of Cyber Local, a £1.9 million initiative to bridge cyber skills gaps and secure the digital economy. Spanning 30 projects across England and Northern Ireland, the scheme emphasizes local business resilience, neurodiverse talent, and cybersecurity careers for youth. Across the Atlantic, the White House introduced the U.S. Cyber Trust Mark, a consumer-friendly cybersecurity labeling program for smart devices. Overseen by the FCC, the initiative tests products like baby monitors and security systems for compliance with rigorous cybersecurity standards, ensuring Americans can make safer choices for their connected homes. China-linked threat actor RedDelta has ramped up its cyber-espionage activities across Asia, targeting nations such as Mongolia, Taiwan, Myanmar, and Vietnam with a modified PlugX backdoor. Cybercriminals have weaponized trust by deploying a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability. CrowdStrike reported a phishing operation impersonating the company, using fake job offers to lure victims into downloading a fraudulent CRM application. Once installed, the malware deploys a Monero cryptocurrency miner. A new Mirai-based botnet, dubbed Gayfemboy, has emerged as a formidable threat, leveraging zero-day exploits in industrial routers and smart home devices. With 15,000 active bot nodes daily across China, the U.S., and Russia, the botnet executes high-intensity DDoS attacks exceeding 100 Gbps. In the Middle East, fraudsters are posing as government officials in a social engineering scheme targeting disgruntled customers. Cybercriminals have weaponized WordPress with a malicious plugin named PhishWP to create realistic fake payment pages mimicking services like Stripe. The plugin not only captures payment details in real time but also sends fake confirmation emails to delay detection.

Dec 20, 2024

Cyware Weekly Threat Intelligence, December 16–20, 2024

In a digital age where borders are blurred, governments are sharpening their strategies to outpace cyber adversaries. The draft update to the National Cyber Incident Response Plan (NCIRP) introduces a comprehensive framework for managing nationwide cyberattacks that impact critical infrastructure and the economy. Meanwhile, the fiscal year 2025 defense policy bill, recently approved by the Senate, emphasizes strengthening cybersecurity measures both at home and abroad. A deceptive health app on the Amazon Appstore turned out to be a Trojan horse for spyware. Masquerading as BMI CalculationVsn, the app recorded device screens, intercepted SMS messages, and scanned for installed apps to steal sensitive data. Malicious extensions targeting developers and cryptocurrency projects have infiltrated the VSCode marketplace and NPM. Disguised as productivity tools, these extensions employed downloader functionality to deliver obfuscated PowerShell payloads. The BADBOX botnet has resurfaced, compromising over 192,000 Android devices, including high-end smartphones and smart TVs, directly from the supply chain. Industrial control systems are facing heightened risks as malware like Ramnit and Chaya_003 targets engineering workstations from Mitsubishi and Siemens. Both malware families exploit legitimate services, complicating detection and mitigation efforts in ICS environments. The Chinese hacking group Winnti has been leveraging a PHP backdoor called Glutton, targeting organizations in China and the U.S. This modular ELF-based malware facilitates tailored attacks across industries and even embeds itself into software packages to compromise other cybercriminals. A tax-themed phishing campaign, dubbed FLUX#CONSOLE, is deploying backdoor payloads to compromise systems in Pakistan. Threat actors employ phishing emails with double-extension files masquerading as PDFs.

Dec 13, 2024

Cyware Weekly Threat Intelligence, December 09–13, 2024

Cybercrime’s web of deception unraveled in South Korea as authorities dismantled a fraud network responsible for extorting $6.3 million through fake online trading platforms. Dubbed Operation Midas, the effort led to the arrest of 32 individuals and the seizure of 20 servers. In a significant move to combat surveillance abuses, the U.S. defense policy bill for 2025 introduced measures to shield military and diplomatic personnel from commercial spyware threats. The legislation calls for stringent cybersecurity standards, a review of spyware incidents, and regular reporting to Congress. The subtle art of deception found a new stage with a Microsoft Teams call, as attackers used social engineering to manipulate victims into granting remote access. By convincing users to install AnyDesk, they gained control of systems, executing commands to download the DarkGate malware. Russian APT Secret Blizzard has resurfaced and used the Amadey bot to infiltrate Ukrainian military devices and deploy their Tavdig backdoor. In a phishing spree dubbed "Aggressive Inventory Zombies (AIZ)," scammers impersonated brands like Etsy, Amazon, and Binance to target retail and crypto audiences. Surveillance has reached unsettling new depths with the discovery of BoneSpy and PlainGnome, two spyware families linked to the Russian group Gamaredon. Designed for extensive espionage, these Android malware tools track GPS, capture audio, and harvest data. A new Android banking trojan has already caused havoc among Indian users, masquerading as utility and banking apps to steal sensitive financial information. With 419 devices compromised, the malware intercepts SMS messages, exfiltrates personal data via Supabase, and even tricks victims into entering details under the pretense of bill payment. Iranian threat actors have set their sights on critical infrastructure, deploying IOCONTROL malware to infiltrate IoT and OT/SCADA systems in Israel and the U.S.

Dec 6, 2024

Cyware Weekly Threat Intelligence, December 02–06, 2024

NIST sharpened the tools for organizations to measure their cybersecurity readiness, addressing both technical and leadership challenges. The two-volume guidance blends data-driven assessments with managerial insights, emphasizing the critical role of leadership in applying findings. The Manson Market, a notorious hub for phishing networks, fell in a sweeping Europol-led takedown. With over 50 servers seized and 200TB of stolen data recovered, the operation spanned multiple countries, including Germany and Austria. Russian APT group BlueAlpha leveraged Cloudflare Tunnels to cloak its GammaDrop malware campaign from prying eyes. The group deployed HTML smuggling and DNS fast-fluxing to bypass detection, targeting Ukrainian organizations with precision. Earth Minotaur intensified its surveillance operations against Tibetan and Uyghur communities through the MOONSHINE exploit kit. The kit, now updated with newer exploits, enables the installation of the DarkNimbus backdoor on Android and Windows devices. Cloudflare Pages became an unwitting ally in the sharp rise of phishing campaigns, with a staggering 198% increase in abuse cases. Cybercriminals exploited the platform's infrastructure to host malicious pages, fueling a surge from 460 incidents in 2023 to over 1,370 by October 2024. DroidBot has quietly infiltrated over 77 cryptocurrency exchanges and banking apps, building a web of theft across Europe. Active since June 2024, this Android malware operates as a MaaS platform, enabling affiliates to tailor attacks. Rockstar 2FA, a phishing platform targeting Microsoft 365 users, has set the stage for large-scale credential theft. With over 5,000 phishing domains launched, the platform is marketed on Telegram. The Gafgyt malware is shifting gears, targeting exposed Docker Remote API servers through legitimate Docker images, creating botnets capable of launching DDoS attacks.