October is finally here and as we look forward to it, let’s take a quick look at the prominent breaches, malware attacks, vulnerabilities, and scams that made a major impact in September.
Talking about malware, several nefarious malware such as Sodinokibi ransomware, Emotet trojan, Nemty ransomware, Astaroth trojan, and Trickbot trojan made a comeback in different cyberespionage campaigns targeting individuals and organizations. The month also witnessed the discovery of various new malware. This includes WiryJMPer malware downloader, Ordinypt wiper, Skidmap backdoor, MobiHok RAT, Dtrack trojan, Gucci botnet, and TFlower ransomware among others.
The month of September also witnessed several instances of attacks due to malicious apps. Roughly 172 harmful apps were removed from Google’s Play Store following the discovery of their involvement in different revenue generation scams. A majority of these apps were disguised as cameras, keyboards, antivirus solutions, and health apps.
Cybercriminals were found leveraging new techniques like Microsoft documents, fake updates and fake SSO signs to bypass email security gateways and conduct phishing attacks. Threat actor groups - Magecart 5, Cobalt Dickens, and Fancy Bear - also managed to pull off some massive cyber-espionage campaigns that caused widespread destructions during September.
In the realm of bugs, threat actors exploited authentication bypass vulnerability, remote code execution vulnerability and other critical security flaws to gain access to systems, servers, and networks of organizations. Various new vulnerabilities such as NetCAT and SACK Panic were also discovered affecting Intel CPUs and Siemens products respectively.
Coming to security fixes and patches, Microsoft had addressed 93 security issues found across its multiple products, while Chrome 77 was released with fixes for 55 security issues.
The following is a consolidated report of all major data breaches, malware, vulnerabilities and scams reported in September.