Cyware Weekly Threat Intelligence - June 10–14

Weekly Threat Briefing • Jun 14, 2019
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Jun 14, 2019
The Good
We’re back with the most interesting threat intel of the week. The past week witnessed several cybersecurity advancements, security incidents, as well as the emergence of new threats. To begin with, let’s first glance through all the positive developments that have emerged over the past week. Google has announced its expansion of Android’s security key technology to iOS devices. Researchers have developed a framework to measure the agility of cyber attackers and defenders. Meanwhile, Microsoft’s Windows 10 v1903, allows users to sign-in to their Microsoft account without a password.
Google has announced that it is expanding Android’s security key technology to iOS devices. This implies that iPhone and iPad users could use Android smartphones as a security key while logging into their Google accounts on an iOS device. For this to work, users should have Bluetooth enabled on both their iOS and Android devices.
A research team from the University of Texas at San Antonio (UTSA) has developed the first framework to score and quantify the agility of cyber attackers and defenders. This cyber agility project is funded by the Army Research Office. This framework will help government and industry organizations to test out numerous and varied responses to an attack.
Microsoft has released Windows 10, version 1903, which allows users to add a passwordless phone number Microsoft account to Windows and to sign-in with the Microsoft Authenticator app. This Microsoft Authenticator app allows users to create a Microsoft account with just their phone number in mobile Office apps and unlock their Microsoft account without a password.
The Bad
Several data breaches and security incidents were witnessed in the past week. The US Customs and Border Protection agency disclosed that the photos of travelers and license plates have been compromised in a cyber attack at one of its contractors. Telegram suffered a powerful DDoS attack originating from China during the Hong Kong protests. Last but not least, ASCO, one of the world’s largest airplane parts manufacturer, suffered a ransomware attack paralyzing the production in factories across various countries.
ASCO, one of the largest airplane parts manufacturer, suffered a ransomware attack crippling production in factories across four countries including Belgium, Germany, Canada, and the United States. ASCO factory in Zaventem, Belgium was hit by a ransomware infection causing major downtime as most of the plant’s IT systems were infected. As a result of which, almost 1,000 of its 1,400 workers were sent home.
The City of Edcouch suffered a data breach after a hacker gained access to the city’s network and stole all the city’s information. The hacker then threatened to erase all the information if a ransom of $40,000 in BTC was not paid. The compromised information includes the personal data of over 3000 residents. The hacker also stole information from the water department and city finances.
A Distributed Denial of Service (DDoS) attack on Telegram messenger caused service outages and connection problems for users primarily in South and North America and other parts of the world. A botnet formed of compromised computers sent huge traffic to Telegram servers which resulted in unstable connections as the messenger could not handle all the requests. The attack originated from China during the Hong Kong protests.
Hackers stole several archived mini discs from the Radiohead’s lead singer Thom Yorke and demanded a ransom payment of $150,000 to stop them from being released to the public. The mini discs contained 18 tracks of OK Computer sessions. Instead of meeting the hacker’s demand, Radiohead themselves released all the stolen tracks on Bandcamp for £18, with all the proceeds going to Extinction Rebellion.
The e-invitations platform Evite has admitted that it suffered a data breach in February. The stolen user data was actually put up for sale in the Dream Market marketplace by the infamous hacker ‘Gnosticplayers’. Evite also provided additional details about the breach. The social planning website revealed that an unauthorized third party gained access to an inactive data storage file that contained Evite user accounts prior to 2013.
Three major private banks in Russia, OTP Bank, Alfa Bank, and HCF Bank had its customer data leaked online. A publicly available database listed as OTP Bank contained personal data of almost 800,000 clients. Another unsecured database that contained data of HCF bank held almost 24,400 customers’ personal information. DeviceLock uncovered two databases that contained customer data of Alfa Bank. The first database included personal data of over 55,000 customers and the second database contained just 504 entries.
The retro gaming site ‘Emuparadise’ suffered a data breach in April 2018, which led to the exposure of account details of almost 1.1 million Emuparadise forum members. The exposed account information included members’ email addresses, IP addresses, usernames, and passwords stored as salted MD5 hashes.
The US Customs and Border Protection agency disclosed that the photos of travelers and license plates have been compromised in a cyber attack at one of its contractors. The CBP said that one of its contractors transferred copies of license plate images and traveler photos collected by CBP to the company’s network, which was later compromised by an attacker. The agency did not reveal the name of the contractor, however, CBP’s public statement sent to the Washington Post included the name “Perceptics” in the title: “CBP Perceptics Public Statement”, indicating that the contractor is Perceptics.
A misconfiguration in the Kingman Regional Medical Center website allowed unauthorized individuals to view and access the information entered into the website by KRMC customers. The information that was accessible by unauthorized persons included customer’s names, dates of birth, and limited medical information.
An unprotected Elasticsearch database belonging to Shanghai Jiao Tong University which is sized 8.4TB has exposed almost 9.5 billion rows of email metadata. Based on the metadata, the researchers were able to find out that all emails were being sent or received by a specific person. The data included the IP address and user agent of the person checking their email.
The City Hall in Lake City, Florida has been hit with the ‘Triple Threat’ ransomware, crippling the City Hall’s email and telephone services. However, all emergency services including Police and Fire are not affected by the attack. Public Safety networks have also been isolated and protected by encryption.
New Threats
The past week also witnessed the occurrence of several new malware strains and vulnerabilities. A new variant of Mirai botnet that uses 18 exploits to target IoT devices has been spotted. FIN8 threat group has resurfaced with a new variant of ShellTea/PunchBuggy backdoor targeting the hospitality industry. Meanwhile, Researchers have uncovered an ongoing crypto jacking campaign, wherein attackers are using NSA hacking tools to compromise vulnerable computers of businesses across the globe.