Cyware Weekly Threat Intelligence - November 14–18
Weekly Threat Briefing • Nov 18, 2022
We use cookies to improve your experience. Do you accept?
Weekly Threat Briefing • Nov 18, 2022
With healthcare-related cyber incidents growing in scale and scope, preparedness before a cyber event has become an important aspect. Keeping this in mind, the FDA and MITRE have issued an updated version of the Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook to help protect healthcare organizations. In another initiative, the Australian government announced the formation of a task force that would assist organizations in countering ransomware attacks.
The FDA and MITRE released an updated version of the ‘Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook.’ The playbook provides healthcare organizations with actionable strategies and resources to respond to cyber incidents, while ensuring the security of medical devices.
In a major crackdown, Ukraine police, along with Europol, dismantled an e-commerce fraud operation that affected 19 countries. Around 55 scammers were involved, who used stolen credit card information to order high-value goods from online shops.
The Australian government has announced the formation of a task force in an attempt to counter ransomware attacks. The government also plans to pass tougher privacy laws, early next year, that will include penalties for serious data breaches.
Ahead of the holiday season, threat actors were found targeting online shoppers using a mixture of tricks. In one campaign, at least seven hacker groups infected Magento and Adobe Commerce websites with RATs to steal customers' information and credit card numbers. In another update, a sophisticated phishing kit was used to mimic several reputed brands and dupe users into believing that their logging on to legitimate websites. A widespread spear-phishing campaign targeting government, academic, philanthropy, and research sectors around the world was also reported this week. Believed to be the work of Mustang Panda APT, the ultimate goal of the campaign was to steal sensitive documents and information.
Security firm NCC Group reported that the month of October witnessed the highest number of DDoS attacks. The industrial sector, followed by healthcare and technology, were the most affected by these attacks.
About 38% of Magento and Adobe Commerce websites have been targeted in TrojanOrders attacks. The attack involves infecting the targeted site with RATs that steal customers' information and credit card numbers when purchasing products in the store.
A wave of spear-phishing attacks orchestrated by the Mustang Panda APT was used to target government, academic, foundations, and research sectors around the world. The infection routines led to the distribution of several malware payloads, such as TONEINS, TONESHELL, and PUBLOAD. The ultimate goal of the attackers was to steal sensitive documents and information, which could be used as entry vectors for the next wave of intrusions.
Kentucky-based CorrectCare Integrated Health, a medical claims processing firm, exposed the PHI of about 600,000 inmates who received medical care during the last decade. The breach occurred due to a misconfigured server that contained data that was almost a decade old.
Iranian state-backed actors exploited the Log4Shell vulnerability in a VMware system to compromise a federal agency. They exploited the vulnerability in an unpatched VMware Horizon server, installed XMRig crypto-mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence.
Public schools in two Michigan counties were forced to halt their operations after a ransomware attack. The schools notified law enforcement agencies and engaged cybersecurity advisors to investigate the incident. As a precautionary measure, the staff asked everyone to refrain from using any school-issued devices.
A sophisticated phishing kit was spotted preying on online shoppers looking for holiday specials. The campaign started in September and continued through October. The kit included several functionalities to impersonate reputed brands and evade detection.
The FBI issued an advisory against tech support scams, in which scammers impersonate support staff from software firms and trick users into giving up their bank account details. The scammers contact victims by phone calls or phishing emails and persuade them to renew the annual subscription service of antivirus that is about to expire.
The Russian scooter-sharing service Whoosh confirmed a data breach that affected the data of 7.2 million customers. Reportedly, the data was found being sold on hacker forums along with other sensitive information such as promotion codes and payment card details.
According to new findings, hundreds of databases on Amazon Relational Database Service (Amazon RDS) are exposing PII, including names, phone numbers, email addresses, marital status, dates of birth, car rental information, and even company logins. The reason behind the leaks stems from a feature called public RDS snapshots, which allows the creation of a backup of the entire database environment running in the cloud and can be accessed by all AWS accounts.
In the last few weeks, Mastodon gained popularity as a replacement for Twitter. But recently a vulnerability was discovered in Glitch, a fork of Mastodon, which could allow attackers to steal user credentials. Attackers can inject form elements and spoof a password form which, when combined with Chrome autofill, would allow them access to the credentials.
New versions of several malware were spotted this week. While new variants of LodaRAT were found alongside RedLine and Neshta trojans in a series of attacks, a new avatar of RapperBot was used exclusively to launch DDoS attacks. Besides, a new crypto miner for hire named Typhon Stealer was found upgraded with abilities to steal crypto wallets, monitor keystrokes, and evade antivirus products.