Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Weekly Threat Intelligence, December 30, 2019 - January 03, 2020

Cyware Weekly Threat Intelligence, December 30, 2019 - January 03, 2020 - Featured Image

Weekly Threat Briefing Jan 3, 2020

The Good

The new year has arrived, and with glasses raised and timeless stories recounted, let’s begin the cybersecurity round up for the past week with the good headlines first. Deutsche Bank, Mastercard, and IDEMIA have come together for the launch of the first card to tap motion code technology. Also, the Department of Homeland Security is looking forward to setting up a centralized vulnerability disclosure platform for all federal government agencies. Further, the York College, UK announced a new apprenticeship course in cybersecurity to help organizations upskill their existing staff.

  • The Department of Homeland Security and the General Services Administration are exploring the option of setting up a centralized vulnerability disclosure platform that could serve as a primary point of entry for security researchers analyzing flaws in government systems. While such a platform might be managed by CISA, other agencies might have to kick in some of their own funding and participation would be voluntary.

  • The York College, UK has launched a new apprenticeship course in cybersecurity to help organizations upskill their existing staff. It has invested $78,000 in a state-of-the-art cybersecurity lab, utilizing the latest virtualized working environment. A study showed that there could be 100,000 unfilled cybersecurity jobs in the UK by 2022.

  • Deutsche Bank, Mastercard, and IDEMIA will be teaming up to introduce the Calma Deutsche Bank Card—the first card in Spain to tap motion code technology. It has a card verification code (CVC) that changes every four hours to enhance the financial institution’s overall security level in the area. More interestingly, the card is expected to reimburse victims of online thievery or non-delivery of items purchased.

The Bad

The holiday season wasn’t a cake walk for employees of some organizations that suffered data breaches and other security incidents this week. Now, Landry Inc. disclosed the discovery of malware on payment processing systems used in its network of restaurants. On the other hand, Wyze Labs confirmed a data leak impacting over 2.4 million of its users. Also, Special Olympics of New York had its email server hacked by attackers to target donors through phishing attacks.

  • Foreign currency service Travelex was forced to take its websites offline following a cyberattack. Its U.K. website is currently offline, displaying a ‘server error’ page. Its corporate site said the site was offline while it makes upgrades. The group added that its investigations so far suggested no personal or customer data compromise.

  • US dining and hospitality corporation Landry’s Inc. disclosed a payment security incident through a company breach notification where it mentioned the discovery of malware on payment processing systems used in its network of restaurants. An investigation has revealed that customers’ payment cards could have been mistakenly swiped on the order-entry systems instead of the PoS terminals. The firm reveals that the payment card swiped between March 13, 2019, and October 17, 2019, may have been affected in the incident.

  • Cryptocurrency exchange Poloniex has enforced a password reset for users whose email addresses and passwords were leaked on Twitter. In an email shared with customers a few days back, Poloniex told that some unknown account shared a list of email addresses and passwords on Twitter claiming that the credentials could be used to log in to Poloniex accounts.

  • Unauthorized access to an employee email account of Moss Adams affected the Personally Identifiable Information (PII) of its customers and employees. Some of the information contained in the breached account includes names and Social Security numbers. The company is in the process of notifying the affected individuals. It has also offered to pay for identity theft protection and credit monitoring services for those affected, as per the law.

  • Smart home tech makers Wyze Labs confirmed a data leak impacting over 2.4 million of its customers. The incident had occurred due to an unguarded Elasticsearch database. The database was left open for over three weeks, from December 4 to December 26, 2019. As a precautionary measure, Wyze logged out all users by pushing a token refresh and added another level of protection.

  • The UK Cabinet Office inadvertently exposed the personal information of 1,000-plus New Year's Honour 2020 recipients which includes several well-known celebrities. Along with their names, the office had shared their home and work addresses and postal codes. The honorees were the ones who have been recognized for their activity in the arts, sciences, medicine, sports, or government.

  • The Special Olympics of New York had its email server hacked around this year’s Christmas holiday and was later used to launch a phishing campaign against previous donors. The hack only affected the communications system that stored contact information and no financial data. The phishing email was camouflaged as an alert of a donation transaction ($1,942.49), set up for automatic deduction from the target’s account within two hours.

  • The IT network of a U.S. Coast Guard maritime facility was brought offline for more than 30 hours after being affected by Ryuk ransomware. In another incident, cloud hosting and managed IT services provider Synoptek was hit by Sodinokibi ransomware. The company paid the ransom in a bid to restore operations. Maastricht University also admitted to have fallen victim to a ransomware attack.

  • Microsoft seized 50 web domains of the North Korean government-backed Thallium hacking group. The seized domains were used by the group in different cyberattacks to send phishing emails and host phishing pages. Most of their targets were based in the U.S., Japan, and South Korea. The goal of many of these attacks was to infect victims with malware such as KimJongRAT and BabyShark.

  • San Antonio’s Center for Health Care Services (CHSC) and Roosevelt General Hospital (RGH) in New Mexico had to bring down their systems in response to a larger-scale cyber-attack. While RGH suffered malware infection on November 14, CHSC was impacted by a handful of attacks during December.

New Threats

The week also saw the discovery of new malware and flaws affecting different software and hardware products. Cisco issued critical security warnings regarding its Data Center Network Manager software that could expose enterprise customers to remote attacks. In other news, the infamous Cloud Hopper attack campaign was found to have affected 14 more companies than earlier expected. Also, researchers reported three critical remote code execution vulnerabilities in Ruckus Wireless routers.

  • Cisco disclosed a dozen bugs affecting its Data Center Network Manager (DCNM) software, including three critical authentication-bypass bugs that could expose enterprise customers to remote attacks. The tech firm warned that a remote attacker can bypass DCNM's authentication and carry out tasks with administrative privileges on an affected device.
  • A malicious extension named Shitcoin Wallet was found stealing passwords and private keys from cryptocurrency wallets and cryptocurrency portals. To initiate the stealing process, the extension requests permission to inject JavaScript code on 77 websites. When users navigate to any of these 77 sites, the extension loads and injects an additional JS file from ‘https://erc20wallet[.]tk/js/content_.js’. The JS file contains the obfuscated code to trick users. Once activated, the malicious JS code records the user’s login credentials, searches for private keys, and finally sends the data to erc20wallet[.]tk.
  • Developers at Starbucks left an API key exposed that could be used by attackers to access internal systems and manipulate the list of authorized users. The issue was rated as ‘critical’ because it could allow attackers to execute commands on systems, add or remove users which have access to internal systems, and potentially AWS account takeover. The key was found in a public GitHub repository.
  • Scammers involved in sextortion email scams were found utilizing new tactics to bypass spam filters. These include sending emails in foreign languages or splitting bitcoin addresses into two parts. Adding these two tactics made it more difficult for the recipient to understand what they are receiving. The emails analyzed claim that a spyware has been installed on the recipient’s system that has captured several inappropriate images and videos of them.
  • A new investigation revealed that the infamous Cloud Hopper attack, led by the China-linked APT10 hacking group, has targeted 14 more companies than expected and could still be active on several companies’ networks. The latest list of victim organizations included at least a dozen cloud service providers including CGI Group Inc., Tieto Oyj, and IBM Corp. The attack against managed service providers had started around late 2016.
  • The logo maker service Vistaprint had exposed more than 638,000 files on an unprotected Amazon S3 bucket. Many of the leaked files were default logo maker images, while the remaining were logos made by users of the Vistaprint logo maker service. The problem was fixed as soon as the issue was noticed by Vistaprint.
  • A new trojan called Lampion was found targeting Portuguese users. It uses anti-debug and anti-VM techniques. The trojan was reportedly distributed via email templates based on the Portuguese Government Finance & Tax. The email includes a link which, when clicked, initiates the download of the malware.
  • Security researchers discovered three critical remote code execution vulnerabilities in Ruckus Wireless routers. The flaws let malicious hackers bypass the routers and take control of it remotely. The vulnerabilities existed in the web-based interface. Ruckus fixed the security flaws with the release of a new 200.7.10.202.92 version and customers were advised to update their router.

Related Threat Briefings

Feb 7, 2025

Cyware Weekly Threat Intelligence, February 03–07, 2025

PyPI is taking a "dead but not gone" approach to abandoned software with Project Archival, a new system that flags inactive projects while keeping them accessible. Developers will see warnings about outdated dependencies, helping them make smarter security choices and avoid relying on unmaintained code. The U.K is bringing earthquake-style metrics to cybersecurity with its new Cyber Monitoring Centre, designed to track digital disasters as precisely as natural ones. Inspired by the Richter scale, the CMC will quantify cyber incidents based on financial impact and affected users, offering clearer insights for national security planning. Kimsuky is back with another phishing trick, this time using fake Office and PDF files to sneak forceCopy malware onto victims' systems. Its latest campaign delivers PEBBLEDASH and RDP Wrapper by disguising malware as harmless shortcuts, ultimately hijacking browser credentials and sensitive data. Hackers have found a new way to skim credit card data - by hiding malware inside Google Tag Manager scripts. CISA is flagging major security holes in Microsoft Outlook and Sophos XG Firewall, urging agencies to patch them before February 27. One flaw allows remote code execution in Outlook, while another exposes firewall users to serious risks. Bitcoin scammers are switching tactics, swapping static images for video attachments in MMS to make their schemes more convincing. A recent case involved a tiny .3gp video luring victims into WhatsApp groups where scammers apply pressure to extract money or personal data. XE Group has shifted from credit card skimming to zero-day exploitation, now targeting manufacturing and distribution companies. A new version of ValleyRAT is making the rounds, using stealthy techniques to infiltrate systems. Morphisec found the malware being spread through fake Chrome downloads from a fraudulent Chinese telecom site.

Jan 10, 2025

Cyware Weekly Threat Intelligence, January 06–10, 2025

The U.K is fortifying its digital defenses with the launch of Cyber Local, a £1.9 million initiative to bridge cyber skills gaps and secure the digital economy. Spanning 30 projects across England and Northern Ireland, the scheme emphasizes local business resilience, neurodiverse talent, and cybersecurity careers for youth. Across the Atlantic, the White House introduced the U.S. Cyber Trust Mark, a consumer-friendly cybersecurity labeling program for smart devices. Overseen by the FCC, the initiative tests products like baby monitors and security systems for compliance with rigorous cybersecurity standards, ensuring Americans can make safer choices for their connected homes. China-linked threat actor RedDelta has ramped up its cyber-espionage activities across Asia, targeting nations such as Mongolia, Taiwan, Myanmar, and Vietnam with a modified PlugX backdoor. Cybercriminals have weaponized trust by deploying a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability. CrowdStrike reported a phishing operation impersonating the company, using fake job offers to lure victims into downloading a fraudulent CRM application. Once installed, the malware deploys a Monero cryptocurrency miner. A new Mirai-based botnet, dubbed Gayfemboy, has emerged as a formidable threat, leveraging zero-day exploits in industrial routers and smart home devices. With 15,000 active bot nodes daily across China, the U.S., and Russia, the botnet executes high-intensity DDoS attacks exceeding 100 Gbps. In the Middle East, fraudsters are posing as government officials in a social engineering scheme targeting disgruntled customers. Cybercriminals have weaponized WordPress with a malicious plugin named PhishWP to create realistic fake payment pages mimicking services like Stripe. The plugin not only captures payment details in real time but also sends fake confirmation emails to delay detection.

Dec 20, 2024

Cyware Weekly Threat Intelligence, December 16–20, 2024

In a digital age where borders are blurred, governments are sharpening their strategies to outpace cyber adversaries. The draft update to the National Cyber Incident Response Plan (NCIRP) introduces a comprehensive framework for managing nationwide cyberattacks that impact critical infrastructure and the economy. Meanwhile, the fiscal year 2025 defense policy bill, recently approved by the Senate, emphasizes strengthening cybersecurity measures both at home and abroad. A deceptive health app on the Amazon Appstore turned out to be a Trojan horse for spyware. Masquerading as BMI CalculationVsn, the app recorded device screens, intercepted SMS messages, and scanned for installed apps to steal sensitive data. Malicious extensions targeting developers and cryptocurrency projects have infiltrated the VSCode marketplace and NPM. Disguised as productivity tools, these extensions employed downloader functionality to deliver obfuscated PowerShell payloads. The BADBOX botnet has resurfaced, compromising over 192,000 Android devices, including high-end smartphones and smart TVs, directly from the supply chain. Industrial control systems are facing heightened risks as malware like Ramnit and Chaya_003 targets engineering workstations from Mitsubishi and Siemens. Both malware families exploit legitimate services, complicating detection and mitigation efforts in ICS environments. The Chinese hacking group Winnti has been leveraging a PHP backdoor called Glutton, targeting organizations in China and the U.S. This modular ELF-based malware facilitates tailored attacks across industries and even embeds itself into software packages to compromise other cybercriminals. A tax-themed phishing campaign, dubbed FLUX#CONSOLE, is deploying backdoor payloads to compromise systems in Pakistan. Threat actors employ phishing emails with double-extension files masquerading as PDFs.

Dec 13, 2024

Cyware Weekly Threat Intelligence, December 09–13, 2024

Cybercrime’s web of deception unraveled in South Korea as authorities dismantled a fraud network responsible for extorting $6.3 million through fake online trading platforms. Dubbed Operation Midas, the effort led to the arrest of 32 individuals and the seizure of 20 servers. In a significant move to combat surveillance abuses, the U.S. defense policy bill for 2025 introduced measures to shield military and diplomatic personnel from commercial spyware threats. The legislation calls for stringent cybersecurity standards, a review of spyware incidents, and regular reporting to Congress. The subtle art of deception found a new stage with a Microsoft Teams call, as attackers used social engineering to manipulate victims into granting remote access. By convincing users to install AnyDesk, they gained control of systems, executing commands to download the DarkGate malware. Russian APT Secret Blizzard has resurfaced and used the Amadey bot to infiltrate Ukrainian military devices and deploy their Tavdig backdoor. In a phishing spree dubbed "Aggressive Inventory Zombies (AIZ)," scammers impersonated brands like Etsy, Amazon, and Binance to target retail and crypto audiences. Surveillance has reached unsettling new depths with the discovery of BoneSpy and PlainGnome, two spyware families linked to the Russian group Gamaredon. Designed for extensive espionage, these Android malware tools track GPS, capture audio, and harvest data. A new Android banking trojan has already caused havoc among Indian users, masquerading as utility and banking apps to steal sensitive financial information. With 419 devices compromised, the malware intercepts SMS messages, exfiltrates personal data via Supabase, and even tricks victims into entering details under the pretense of bill payment. Iranian threat actors have set their sights on critical infrastructure, deploying IOCONTROL malware to infiltrate IoT and OT/SCADA systems in Israel and the U.S.

Dec 6, 2024

Cyware Weekly Threat Intelligence, December 02–06, 2024

NIST sharpened the tools for organizations to measure their cybersecurity readiness, addressing both technical and leadership challenges. The two-volume guidance blends data-driven assessments with managerial insights, emphasizing the critical role of leadership in applying findings. The Manson Market, a notorious hub for phishing networks, fell in a sweeping Europol-led takedown. With over 50 servers seized and 200TB of stolen data recovered, the operation spanned multiple countries, including Germany and Austria. Russian APT group BlueAlpha leveraged Cloudflare Tunnels to cloak its GammaDrop malware campaign from prying eyes. The group deployed HTML smuggling and DNS fast-fluxing to bypass detection, targeting Ukrainian organizations with precision. Earth Minotaur intensified its surveillance operations against Tibetan and Uyghur communities through the MOONSHINE exploit kit. The kit, now updated with newer exploits, enables the installation of the DarkNimbus backdoor on Android and Windows devices. Cloudflare Pages became an unwitting ally in the sharp rise of phishing campaigns, with a staggering 198% increase in abuse cases. Cybercriminals exploited the platform's infrastructure to host malicious pages, fueling a surge from 460 incidents in 2023 to over 1,370 by October 2024. DroidBot has quietly infiltrated over 77 cryptocurrency exchanges and banking apps, building a web of theft across Europe. Active since June 2024, this Android malware operates as a MaaS platform, enabling affiliates to tailor attacks. Rockstar 2FA, a phishing platform targeting Microsoft 365 users, has set the stage for large-scale credential theft. With over 5,000 phishing domains launched, the platform is marketed on Telegram. The Gafgyt malware is shifting gears, targeting exposed Docker Remote API servers through legitimate Docker images, creating botnets capable of launching DDoS attacks.