Cyware Weekly Threat Intelligence - February 14–18
Weekly Threat Briefing • Feb 18, 2022
We use cookies to improve your experience. Do you accept?
Weekly Threat Briefing • Feb 18, 2022
The Good
It has been a good week for cybersecurity. The future of quantum key distribution for secure cryptography is here as researchers from three organizations developed a novel technique that can fight against quantum computing attacks. In a welcome move, the U.S. Postal Service (USPS) is extending its Emergency Management System to bolster ransomware and breach response.
Researchers from JPMorgan Chase, Ciena, and Toshiba developed a unique Quantum Key Distribution (QKD) network for metropolitans, which is resistant to quantum computing attacks. The QKD network sustains encryption of 800Gbps under real-world conditions and can rapidly identify and defend against quantum computing threats.
Singapore to design a quantum-safe network to display crypto-agile connectivity and encourage trials with private and public firms. The initiative is driven by the Quantum Engineering Program (QEP) and includes a quantum security lab for vulnerability research. The project is supported by the National Research Foundation, along with 15 partners from both public and private sectors. The three-year program aims to conduct an extensive analysis of security systems and design guidelines to support organizations adopting quantum-safe technologies.
The U.S. Postal Service announced to expand its Emergency Management System to include ransomware attacks and exploitation of computer vulnerabilities. The new project would put the professional and personal data of the employees and contractors into the federal information ecosystem.
The Bad
Coming to the noteworthy security incidents this week, Ukraine is undergoing a major cybersecurity crisis as several government websites were knocked offline due to a series of massive DDoS attacks. The SquirrelWaffle backdoor is back and is now abusing Microsoft Exchange Server bugs to perform financial fraud. A mysterious threat actor, TA2541, was found staying under the radar since 2017. It has been targeting the aviation sector via off-the-shelf malware.
A new update on the cyberattack at the International Committee of the Red Cross (ICRC) revealed that the hackers had accessed the networks 70 days before the attack. They exploited a critical severity authentication bypass flaw, tracked as CVE-2021-40539, in Zoho’s ManageEngine AdSelfService Plus to breach the network. The attackers had impersonated legitimate users to hide their presence in the environment.
A statement released by the CISA reveals that Russian state-sponsored operatives are targeting U.S. cleared defense contractor networks to obtain sensitive information. Some of these attacks have been ongoing for at least six months. According to the agency, threat actors are using tactics such as spear-phishing and brute-force attacks to breach networks.
The FBI is warning about the rise in BEC scams against U.S. organizations and individuals. The agency shared that the scammers had lately turned to virtual meeting platforms to match the overall trend of businesses moving to remote work during the pandemic.
A series of DDoS attacks knocked off several government and banking websites in Ukraine. This included the websites of the defense ministry, foreign and culture ministry, and the two largest state-owned banks - Privatbank and Sberbank. Meanwhile, the banks have managed to restore their operations and websites following the attacks.
The Internet Society (ISOC) has inadvertently exposed the personal data of more than 80,000 members due to an unprotected Microsoft Azure cloud repository. The misconfigured repository contained millions of JSON files, including full names, email addresses, mailing addresses, and login details of members.
SquirrelWaffle backdoor is targeting Microsoft Exchange servers vulnerable to ProxyLogon and ProxyShell vulnerabilities. While the malware initially targeted the servers to distribute Cobalt Strike beacons through hijacked email threads, researchers uncovered one email thread conversation that conducts financial fraud.
The CISA has added a list of nine bugs to its Known Exploited Vulnerabilities catalog. Two of these are related to Chrome and Magento. The flaws are an improper input validation flaw in Adobe Commerce and a use-after-free vulnerability in Google Chrome.
A low-lying threat actor tracked as TA2541 is believed to have been targeting entities in the aviation sector since 2017. The attacker used off-the-shelf malware and relied on malicious Microsoft Word documents to deliver trojans such as AsyncRAT, NetWire, WSH RAT, and Parallax. Most of the themes included transportation-related terms such as flight, aircraft, fuel, yacht, charter, etc.
New South Wales Premier Dominic Perrottet has admitted a data leak due to a misconfigured NSW government website. This affected more than 500,000 addresses, including defense sites, a missile maintenance unit, and domestic violence shelters, among others.
The U.S Federal Bureau of Investigation (FBI) has issued an advisory to warn about recent breaches involving the BlackByte ransomware group. The gang has targeted at least three critical infrastructure organizations in the U.S in the last three months. The advisory focuses on providing IoCs that organizations can use to detect and defend against BlackByte’s attacks.
The San Francisco 49ers NFL team confirmed a ransomware attack that encrypted the files on its corporate IT network. The attack is the work of the BlackByte ransomware gang which also claimed responsibility by leaking some stolen files on its site. The firm added that it has taken mitigation steps to contain the attack and has also informed the law enforcement agencies.
A New York-based fertility clinic, Extend Fertility, is notifying patients about a recent security breach that compromised their personal details. The incident was discovered on December 20, 2021, and the compromised data includes dates of birth, user names, dates of service, medical account number, medical history, and treatment information of patients.
New Threats
Ice ice everywhere and cybercriminals are grabbing chunks of it. Not actual ice but ice phishing - Microsoft discovered this new campaign targeting blockchain and web3. Multiple times a month. Horrendous! While we are on the topic of crypto, a new scam is targeting NFT buyers. One of the scams has been associated with the Babadeda crypter. The Iran-linked Moses Staff actor was found leveraging StrifeWater RAT. This previously undocumented malware comes with multiple functionalities.