Cyware Weekly Threat Intelligence, March 30-April 03, 2020

Weekly Threat Briefing • Apr 3, 2020
This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.
Weekly Threat Briefing • Apr 3, 2020
The Good
With hundreds of organizations heavily relying on video teleconferencing (VTC) platforms to perform their business operations during this ongoing COVID-19 pandemic, it has become important to protect these tools from any kind of cyberattacks. Keeping this in mind, the FBI has issued a list of security measures against VTC hijacking and Zoom-bombing attacks for users and administrators. The guidelines aim to improve the cybersecurity of VTC software. In other developments, the Ministry of Defense in Japan has decided to build an AI-based system to detect malicious emails and other unwanted intrusions.
The Federal Bureau of Investigation (FBI) has released guidelines on defending against video teleconferencing (VTC) hijacking and Zoom-bombing attacks. The recommendations are proposed for those individuals and organizations that are increasingly dependent on VTC platforms like Zoom and Microsoft Teams.
Japan’s Ministry of Defense has planned to invest a sum of $237 million in cybersecurity this year. A portion of this amount will be diverted towards an artificial intelligence-based system that can counter cyberattacks.
Akamai, Amazon Web Services, Azion, Cloudflare, Facebook and Netflix have joined the Internet Society-backed Mutually Agreed Norms for Routing Security (MANRS) initiative that was launched six years ago. The program aims to advance the security and resiliency of the Internet’s routing infrastructure.
The Bad
Talking about data breaches, Marriott International revealed that the personal information of about 5.2 million guests was impacted due to unauthorized access to its employees’ login credentials. In a different incident, SOS Online Backup had leaked over 135 million records due to an unprotected database.
Voter information of more than 4.9 million Georgians was affected after cybercriminals had put it on sale on a hacking forum. The information included full names, home addresses, dates of birth, ID numbers, and mobile numbers of individuals.
Marriott International disclosed a data breach that impacted the personal information of about 5.2 million hotel guests. The breach had occurred after hackers gained unauthorized access to the login credentials of two employees at a franchise property.
SOS Online Backup had inadvertently leaked over 135 million records last year due to a misconfigured database. The exposed information included full names, email addresses, phone numbers, internal company details, and account usernames of clients.
The popular video-conferencing app, Zoom, came under fire for leaking personal information of at least a thousand users due to an issue in its settings. The bug resulted in the leak of users’ email addresses and photos.
A spear-phishing attack on GoDaddy.com gave phishers the ability to view and modify key customer records. The incident had affected the domain settings for a half-dozen of its customers, including the transaction brokering site, escrow.com.
A trove of 42 million records from a third-party app of Telegram was leaked through an Elasticsearch cluster targeted by a group called ‘Hunting system’. The exposed data included usernames, phone numbers, account IDs, hashes, and secret user keys.
A new skimmer dubbed ‘MakeFrame’ compromised 19 different e-commerce websites to steal customers’ payment data. The attacks were attributed to Magecart Group 7.
A hacker had managed to break into over 15000 Elasticsearch servers and defaced them as they were not protected with passwords.
New threats
The week saw a tremendous increase in cyberattacks related to COVID-19 disease. Two of these attacks were executed using phishing emails and distributed malware like the new BlueTea Action trojan, LokiBot trojan, Zeus Sphinx trojan, and Remcos RAT. The widely used Zoom came under the scanner after researchers detected two zero-day flaws in the macOS version of the app. Additionally, security experts discovered several trojanized versions of the video conferencing app that were distributed via third-party stores.