Cyware Weekly Threat Intelligence - January 09–13

Weekly Threat Briefing • Jan 13, 2023
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Jan 13, 2023
The healthcare sector has always been at risk of third-party attacks owing to a huge trove of PHI that is ripe for misuse by threat actors. With an aim to protect this information, a group of over 20 healthcare organizations has come together to form the Health3PT Council which aims at introducing new standards and automated workflows. In another development, New York has ramped up its cybersecurity investment with an additional top-up of $35 million for this year’s state cybersecurity budget.
Meanwhile, ransomware groups are as usual having a field day, targeting multiple organizations and stealing their confidential data. While the LockBit ransomware was claimed to be behind the recent attack against the U.K’s Royal Mail, the Hive ransomware group leaked 550 GB of data stolen from Consulate Health Care. An ongoing spear-phishing attack from Dark Pink APT has also been found aiming at government and military organizations in Asia-Pacific.
The Liquor Control Board of Ontario in Canada began an investigation into a cybersecurity incident that knocked out its website and mobile app. The firm said its shops were open to customers as they were unaffected.
Access to the websites of the Danish Central Bank and seven private banks in the country were briefly disrupted following a DDoS attack. Attackers redirected unwanted traffic to the targeted servers in a bid to knock them offline. Among the banks affected were Jyske Bank and Sydbank.
A new Facebook-themed phishing attack was reported by researchers. Attackers leveraged Facebook copyright infringement notices, and other related artifacts to steal credentials from users. The attack started with a basic email from Facebook stating that the recipient’s account has been suspended.
A zero-day vulnerability (CVE-2022-42475) in FortiOS SSL-VPN that Fortinet addressed last month was exploited by threat actors to target government organizations. The end goal was to deploy a generic Linux implant to compromise Fortinet’s IPS software and establish connections with a remote server to download additional malware.
A cyberattack on Royal Mail has been linked to the LockBit ransomware operation. Reports suggest that the ransomware encrypted devices used for international shipping and caused ransom notes to be printed on printers used for custom dockets.
The Hive ransomware group leaked 550 GB of data, including employee and customer PII, stolen from Consulate Health Care. The leaked samples include stolen contracts, agreement documents, and the company’s private info. This also included email addresses, phone numbers, credit card details, Social Security numbers, and medical records of employees.
The Dark Pink APT group is currently using spear-phishing emails to launch attacks against government and military organizations in Asia-Pacific. The group has been linked to seven successful attacks between June and December 2022.
Social marketplace Trustanduse left data of around 439,000 users including businesses exposed for at least six months. The unsecured data included sensitive information such as usernames, full names, Facebook IDs, phone numbers, and passwords hashed with the BCrypt algorithm.
Bay Bridge Administrators started notifying around 250,000 individuals of a September 2022 data breach. The compromised information includes names, addresses, birth dates, Social Security numbers, ID and driver’s license numbers, and medical and health insurance information.
The Serbian Ministry of the Interior suffered a DDoS attack over the weekend, crippling the IT infrastructure. The government took the required security measures to thwart the attack and protect the data of the Ministry of Internal Affairs.
Several notorious malware resurfaced in different attack campaigns reported this week. While Vidar infostealer was found being distributed via over 1300 domains impersonating known official sites, the GootKit loader was discovered leveraging SEO poisoning to target the Australian healthcare industry. A cybercrime group tracked as Scattered Spider was also observed exploiting an old flaw as part of a BYOVD attack.