Cyware Weekly Threat Intelligence, November 04 - 08, 2019

The Good

It’s nearly the end of another week, which means it’s time to review the weekly happenings in cyberspace. Before diving into breaches and threats, let’s look at the positive events. The Cybersecurity and Infrastructure Security Agency (CISA) has released a cybersecurity guide called Cyber Essentials for small businesses and government agencies. Google has announced a collaboration called ‘App Defense Alliance’ with three security firms to boost malicious app detection. Meanwhile, senators have introduced ‘The Harvesting American Cybersecurity Knowledge through Education Act’ bill to improve cybersecurity education programs.

• The Cybersecurity and Infrastructure Security Agency (CISA) released ‘Cyber Essentials’, a cybersecurity guide for small businesses and government agencies. It includes a list of actionable items that entities can practice to reduce cyber risks.
• Google announced a partnership called ‘App Defense Alliance’ with three cybersecurity firms. This collaboration will aim at enhancing the detection of Potentially Harmful Applications (PHAs). The partners will analyze the dataset before an application goes live on the Google Play Store.
• Senators have introduced a new bill called ‘The Harvesting American Cybersecurity Knowledge through Education Act’ that enhances the existing cybersecurity education. This legislation will provide better resources and pathways to strengthen America’s cybersecurity workforce.
• Google has launched a new open-source silicon root of trust project. Named ‘OpenTitan’, this project focuses on boosting the cybersecurity posture of servers, storage, and other devices in data centers. OpenTitan is said to be managed by lowRISC, a non-profit organization.

The Bad

Several security compromises were reported this week. Media giant Nikkei was hit by a BEC scam that resulted in a loss of around $29 million. Cadena SER and Everis in Spain suffered ransomware attacks that disrupted their networks. In other news, Facebook disclosed that about 100 partners may have accessed the information of members in certain Facebook groups.

• Nikkei, one of the world’s largest media corporations, lost around $29 million to a Business Email Compromise (BEC) scam. An employee was tricked into sending the funds to an attacker-controlled account. The company is said to be in the process of recovering the stolen funds.
• Spain’s largest radio station Cadena SER and an NTT DATA company Everis were hit by ransomware attacks. SER is said to be impacted by an unknown ransomware strain that forced the radio station to disconnect all its systems from the internet. Security experts believe that Everis’ data was encrypted by the BitPaymer ransomware.
• Facebook disclosed that around 100 partners may have accessed user information such as names and profile pictures of members in certain Facebook groups. The social media giant said that although there was no evidence of access abuse, the partners have been asked to delete retained member data. An audit is also said to be conducted to confirm the deletion of data.
• A BEC scam hit the City of Ocala in Florida this week. This scam involved the impersonation of an employee of a firm that the city is currently working with. More than $742,000 was redirected to the scammer-controlled accounts in this incident.
• The personal and billing data of some Three UK customers were left exposed for a brief period of time. The British telecom firm said that no sensitive financial information was exposed and that it is investigating the matter. A similar incident was reported in February this year.
• The Canadian Nunavut region government suffered a ransomware attack that impacted most government services including finance, legal, and medical systems. Officials are working with cybersecurity experts on investigating the attack. Most of the impacted files are expected to be restored from backups.
• The Utah Valley Eye Center notified 20,000 patients who were the victims of a data breach that happened a year and a half ago. The breach occurred on June 18, 2018, when hackers gained unauthorized access to a third-party portal of the clinic. The potentially compromised information includes names, addresses, dates of birth, and phone numbers.
• Cybersecurity firm Trend Micro disclosed a security incident involving a malicious insider threat. Names, email addresses, support ticket numbers, and some telephone numbers may have been compromised due to this incident. A Trend Micro spokesperson reportedly said that around 70,000 customers have been impacted.
• Maritime services provider James Fisher & Sons (JFS) revealed that it fell victim to a cyberattack last week. As a precautionary measure, the firm has shut down its digital systems. The company’s IT staff, law enforcement officials, and a third-party company are working on recovering data from the backups.
• Veritas Genetics, a DNS-testing firm has confirmed a security breach that exposed customer information. The firm said that it detected unauthorized access to a customer-facing portal recently. Genetic data, DNA-test results, and health records are not contained in the portal.
• Several systems in the Brooklyn Hospital Center were infected by a ransomware attack. The hospital chose not to pay the ransom and decided to recover data from the backup. Unfortunately, the data recovery process failed and resulted in the permanent loss of patient data.
• Maine healthcare provider InterMed suffered a data breach that impacted the personal health information of 30,000 patients. The potentially compromised information includes names, dates of birth, health insurance information, and clinical information.

New Threats

This week’s highlights include a number of new vulnerabilities and malware strains. The infamous Nemty ransomware was observed to be delivered by the Trik botnet. The Emotet Trojan has resurfaced in a fresh wave of attacks. On the other hand, a new ‘Light Commands’ vulnerability that can be used to hack smart voice assistants has been disclosed.

• Researchers observed that the Nemty ransomware is being delivered by the Trik botnet, which has expanded its reach. The Nemty ransomware is spread to systems with exposed Server Message Block (SMB) network communication protocol. The malware has been observed to be in continuous development since its first appearance in August 2019.
• The infamous Emotet Trojan has been observed in a new wave of attacks. Researchers noted that the malware had undergone changes in functionality and deployment. The malware authors had used a new list of words to create process names.
• A new attack technique that can exploit the ‘Light Commands’ vulnerability to hack smart voice assistants has been discovered. The vulnerability is a design flaw in the micro-electromechanical systems (MEMS) microphones that convert voice commands into electrical signals. Attackers can leverage this vulnerability to perform malicious activities.
• A new Megacortex ransomware version has been discovered by researchers. This version encrypts files, changes logged in user’s passwords and threatens to publish files if the ransom is not paid. The new version has a number of changes compared to the previous version, including the usage of .m3g4c0rtx extension.
• Google has identified a vulnerability in Libarchive that can be exploited to execute code on the target system using a malformed archive file. Tracked as CVE-2019-18408, this flaw impacts operating systems including Debian, Ubuntu, Gentoo, Arch Linux, FreeBSD, and NetBSD. The affected operating systems have rolled out patches for this flaw.
• A new phishing scam that uses fake court summon emails to deliver information-stealing malware has been spotted. The distributed malware, Predator the Thief, is capable of harvesting usernames, passwords, cryptocurrency wallet contents, and browser data. This campaign is targeting employees in the retail and insurance sector.
• Security experts noted that scammers were using legitimate web analytics tools including those developed by Google, Bing, and Yandex to track the success of phishing campaigns. The data collected from these campaigns were used to tweak the campaigns to boost success rates.
• Attackers have been observed using a specially crafted ZIP file to bypass secure email gateways to distribute the NanoCore RAT. This campaign employs spam emails that appear to be shipping information from an Export Operation Specialist of USCO Logistics.
• The Department of Homeland Security, FBI, and Department of Defense released a notification on a new data collector malware called Hoplight that is reportedly used by Hidden Cobra, a North Korean cyberespionage group. The malware is said to be sophisticated enough to disguise network connection.
• Researchers disclosed a vulnerability in Amazon Ring doorbells that exposed the passwords of connected Wi-Fi networks. This vulnerability can be exploited by malicious actors to launch massive attacks. Amazon has fixed this vulnerability in all Ring devices.