Cyware Daily Threat Intelligence, June 14, 2021

Take a look at all the ransomware attacks over the past few years and you will see a massive evolution in the sophistication of such attacks. Threat groups are firmly determined to make greater financial gains. And, if not money, the purpose is often espionage. A recent attack on several airline carriers including has been attributed to the China-linked APT41 threat group. The entire airline industry has been recommended to scour their networks for traces of its malicious activity.

While we are trying to deal with this latest development, another monumental breach affected Audi and Volkswagen as unsecured data was exposed to the open internet. In a positive development, the prolific Avaddon ransomware gang announced to shut down its operations and provided thousands of decryption keys for victims to recover their data.

While one threat lays low, another rears its head. A Mirai botnet variant was found scanning Tenda routers for known but uncommon vulnerabilities. The malware primarily targets exposed and vulnerable Docker APIs to include them in its DDoS botnet.

Baby clothes retailer Carter’s inadvertently exposed over 410,000 records, dating back years, according to a new disclosure. The issue stemmed from shortened URLs generated by Linc which lacked basic security protections. The links contained purchase details, tracking information, and more.