The Good

We hope you have your cuppa ready and have made yourself comfortable on your couch, bed, or that ergonomic chair. This week has showered some really good news on the cybersecurity community and we want you all to enjoy it as much as we did. Small businesses in the UK don’t have to worry anymore about their cybersecurity posture as help has arrived. On the other side of the pond, the NSA released a document that states the importance of zero trust within networks and how it can benefit organizations.

• The NSA published a document that explains the benefits of choosing a zero-trust model and advises how to implement it within one’s networks.

• A team of researchers from the Queen Mary University of London developed COVIDGuardian, a tool to identify security and privacy risks associated with COVID-19 contact tracing apps.

• Backed by GCHQ, the National Cybersecurity Center, the U.K, has launched a new online self-assessment tool for micro-businesses and sole traders. Depending on the security posture of these businesses, the tool will advise on ways to enhance security.

• Scientists generated streams of entirely random numbers at approx. 100 times the speed of the fastest random number generator systems, using a single, chip-scale laser. This system can be utilized to generate cryptography keys.

• A Memorandum of Understanding was signed by CERT-EU and ENISA as an outcome of the Cybersecurity Act to detect and fortify the synergies between the two agencies. The collaboration is believed to build and strengthen the cybersecurity capabilities at the Union Level.

The Bad

We don’t really have a better way to put this - we have had way too many data breaches this week. The Accellion FTA flaws keep claiming more victims. Databases are still not secured properly. When will human errors reduce? Ringostat and Mariana Tek suffered breaches due to unsecured storage servers. For more of the bad news, please read on.

• Qualys is the latest victim of the data breach that occurred due to zero-day flaws in Accellion FTA. The incident has affected over 100 companies that used legacy file-transfer software from Accellion.

• CompuCom informed its customers of a ransomware attack by DarkSide following the acquiring of admin credentials for the Office Depot subsidiary by the adversaries.

• Malaysia Airlines has disclosed details about a data breach that spanned for nine years. This resulted in the compromise of the personal information of members in its Enrich frequent flyer program.

• Payroll giant PrismHR has likely suffered an outage due to a ransomware attack that disrupted its 200 PEO clients across the country. The firm is working on getting the affected system back online.

• An Elasticsearch database belonging to phone-tracking service Ringostat had leaked millions of phone numbers, recordings, metadata, and call logs. The database had exposed over 800 GB of user data.

• The U.S.-based Mariana Tek company had exposed more than 1.5 million user records due to an unsecured Amazon AWS bucket. The records included full names, email addresses, phone numbers, postal codes, and account balances of users.

• Confidential data associated with Tether and Polecat has been held for ransom following cyberattacks. While the attack on Tether is due to ransomware, Polecat’s Elasticsearch database was targeted in a Meow attack.

• American telecommunications provider T-Mobile has warned its users to change their login credentials after being hit by a data breach. While there is no evidence as to whether the attackers gained access to the employees’ accounts, T-Mobile claimed that there is a chance of SIM swapping attacks as the attackers were able to port mobile numbers.

• DDoSecrets hacktivist group has stolen around 70 GB of personal data from Gab, the Twitter-like social networking service. This has put more than 40 million public and private posts, messages, as well as user profiles and hashed passwords at risk of exposure.

• The Russian-speaking Maza cybercriminal forum has reportedly suffered a data breach leading to the leak of user data. The forum has been used to sell stolen financial data and payment card information and discuss topics, such as malware, exploits, spam, and money laundering, among others. Roughly 2,000 accounts have been exposed as a result of the breach.

New Threats

It seems that cybercriminals have started taking the idea of recycling seriously. No, not in an environmental context, but in the context of malware code. Just when you thought that we were probably moving on from the SolarWinds attack, researchers have managed to baffle us yet again with the discovery of three more malware variants. Also, Ursnif made a comeback and has launched attacks on Italian banks. Why Italy? We don’t know.

• Three more malware strains—GoldMax, Sibot, and GoldFinder—related to the SolarWinds supply chain attack have been discovered by Microsoft and FireEye. These tailor-made malware were introduced after the threat actor has gained access to specific networks.

• The Ursnif Trojan has been traced back to attacks against at least 100 banks in Italy. These attacks led to the loss of credentials and financial data. In one case, an unnamed payment processor had over 1,700 sets of credentials stolen.

• The Lazarus Group has been found using its MATA malware framework to deploy TFlower ransomware. The campaign using this ransomware has targeted a dozen victims for data exfiltration or extortion.

• Scammers are targeting investors in a sophisticated BEC scam with an average payout of $809,000. The scam begins with a phishing email that asks the targeted investors to send money under the pretext of fake ‘capital call’ notices.

• A new imposter scam that impersonates the Inspector General for SSA has been found tricking users into handing over their personal information.

• New research reveals that the SunCrypt ransomware shares similarities with QNAPCrypt ransomware, which targets Linux-based file storage systems. Investigation says that the QNAPCrypt and an early version of SunCrypt share identical code logic for file encryption.

• Threat actors leveraging Search Engine Optimization (SEO) techniques in a newly found Gootloader technique to distribute malware to as many victims as possible. The technique spread the Gootkit banking Trojan, Kronos, Cobalt Strike, and REvil ransomware, among other malware variants, in South Korea, Germany, France, and the United States.

• Researchers have traced a cyberespionage campaign that distributes ObliqueRAT malware. The trojan is distributed as benign image files on hijacked websites and used against organizations in South Asia.

• Threat actors are targeting Amazon, Zillion, Lyft, and Slack NodeJs apps using a new Dependency Confusion vulnerability to steal Linux/Unix password files and open reverse shells.

• A new variant of Ryuk ransomware that includes self-propagation capabilities has been uncovered by researchers. It makes use of privileged accounts and machines based on the Windows domain only for propagation.