Cyware Weekly Threat Intelligence, December 09 - 13, 2019

Weekly Threat Briefing • Dec 13, 2019
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Dec 13, 2019
The Good
Ready to kickstart your weekend celebrations? Same here. But before we proceed, let’s quickly glance at positive developments made in cybersecurity this week. Google introduced better password protections and new real-time alert systems for phishing attempts on devices. Also, the U.S. Senate formally approved the legislation to establish a consortium to develop and prepare state and local governments’ cyber readiness program.
Google has introduced a new real-time alert system that warns users of phishing attempts. These new protections can inspect the URLs of pages visited with Safe Browsing’s servers in real-time. The additional features include phishing protections and tab freezing to further control tab actions. Google expects that predictive phishing protection will protect hundreds of millions of people.
The U.S. Senate has passed legislation to formally charter a National Cybersecurity Preparedness Consortium (NCPC) to foster preparedness among state and local governments and first responders for cyber emergencies. With Norwich as a founding member, the new law will allow DHS and NCPC to work together to develop multi-year plans for improving cyber readiness.
The Bad
Meanwhile, it remained a challenging week for organizations with big hacks and ransomware incidents. Over 2.7 billion email and password combinations were leaked online on an unprotected server. Also, Maze ransomware operators have taken the credit for the attack on leading wire and cable manufacturer Southwire Company. Further, over 752,000 birth applications were left exposed in the U.S due to an unguarded AWS storage bucket.
More than 2.7 billion email addresses were left open on the web by an unnamed party. Surprisingly, over a billion of these records contained passwords in plain-text. Many of those leaked email addresses used domains of China’s biggest internet companies such as Tencent, Sina, Sohu, and NetEase. The database owner is yet to be identified.
Maze Ransomware operators claimed responsibility for the attack on Southwire Company, LLC (Southwire) from Carrollton, Georgia. The ransomware affected computing systems on a company-wide basis and demanded 850 BTC, which is approximately $6 million in ransom.
More than 752,000 applications were compromised when an online company, that allows people in the U.S. to obtain a copy of their birth certificate, left its AWS storage bucket server open. U.K-based Fidus Information Security reported about the exposed data and TechCrunch verified the same by matching names and addresses against public records.
Researchers disclosed that more than 455,000 Turkish payment cards were being sold online on the popular Joker's Stash marketplace. After going through the card types and issuing banks, researchers suggested that the data came from a source that handles payments. Authorities are suspecting Magecart attackers (JS skimmers) behind this, also because of the popularity, it has earned recently.
Airtel, India’s third-largest telecom network, admitted to an API security flaw in its smartphone app which could have exposed the personal data of more than 300 million users. Potentially exposed information includes name, address, email, date of birth, and network information among others.
In Argentina, attackers encrypted 10 years’ worth of government data using a ransomware. Approximately 7,700 GB of data was compromised as a result of the attack. Reports suggested that attackers demanded somewhere between $37,000 and $370,000 (0.5 and 50 BTC) in exchange for decrypting the files. However, the government said that it had recovered 90 percent of data by itself.
The details of over 15 million Iranian bank cards were published online after hundreds of bank branches were set on fire last month by demonstrators. Experts suspect a state-sponsored cyberattack and the largest financial scam in Iran’s history. The breach, which mostly targeted Iran’s three largest banks, affected close to one-fifth of the population.
STCS, a Saudi Arabian telecom company, was found exposing hundreds of thousands of constantly updated GPS locations on its server. The unknown source reported that the unprotected server contained an instance of Kibana, a piece of software for sorting and visualizing data. The last 15 minutes of rolling data consisted of over 140,000 entries.
The networks of BMW and Hyundai car manufacturers were breached by the Ocean Lotus hacker group. The attackers said to have used a penetration testing toolkit called Cobalt Strike as a backdoor to compromise networks.
Colorado-based IT provider Complete Technology Solutions fell victim to a ransomware attack that impacted the operations of more than 100 dental practices in the U.S. Experts suggested that the intruders compromised a remote access tool that did not have two-factor authentication (2FA) activated.
New Threats
The week was seemingly full of threats and alerts. A new version of VegaLocker ransomware called Zeppelin was found affecting IT and healthcare services in the U.S. Canada, and Europe. In other news, a cyberespionage group returned with new evasion techniques only to target technology companies and government agencies in East Asia. Also, there was a critical flaw reported to be existing in Intel CPUs that use SGX, a solution designed to protect data in the private regions of memory.