Share Blog post
- A group of academics at Carnegie Mellon University’s CyLab created a prototype of security and privacy labels for IoT devices to shed light on a device's security posture and, also, explain how it manages user data and privacy controls.
- Researchers from CSIRO’s Data61 developed a new technique to protect users from voice spoofing attacks that use synthesized speech for voice recognition. The new solution, called Void, identifies the differences in spectral power between a live human voice and a voice replayed through a speaker.
- With 99% accuracy, researchers at the University of Texas formulated a tool to determine whether an Android game or other kinds of mobile apps comply with the federal Children’s Online Privacy Protection Act (COPPA) or not.
- Starting from September 1, 2020, all the U.S. [.]gov sites will only be accessible via HTTPS. The protocol will protect visitors’ connections by encrypting exchanged data and protecting them from man-in-the-middle attacks.
- The CISA planned to roll out a new Domain Name System (DNS) resolver service to ensure the resilience of online systems. The service will also enable the CISA to gain insights into active cyber threats to analyze and protect federal agencies.
- Ransomware continued to run rampant, ransacking the targeted organizations’ sensitive information and networks. While the Maze ransomware gang claimed attacks on LG Electronics and MaxLinear Inc., the operators of CLOP and Nefilim ransomware disrupted the business operations of IndiaBulls and Fisher & Paykel, respectively.
- A hacktivist group, dubbed ‘Distributed Denial of Secrets’ (DDoSecrets), leaked 296 GB of data associated with more than 200 U.S. law enforcement agencies and fusion centers. The leaked files, dubbed BlueLeaks, included more than one million files, such as emails, videos, audio files, and scanned documents among others.
- The U.K National Health Service (NHS) confirmed that some 113 internal email accounts were compromised to send malicious spam messages outside the organization. The emails sent using the breached account included a link to a fake login page of the NHS.
- A threat actor group, named CryptoCore, stole around $200 million from different cryptocurrency exchanges located in the U.S., Japan, and the Middle East. The amount was stolen by the actors over a span of around two years.
- A misconfigured AWS S3 bucket leaked 845GB of data belonging to different dating apps. The affected apps included 3somes, CougarD, Gay Daddy Bear, Xpal, BBW Dating, SugarD, GHunt, and Herpes Dating.
- The City of Florence paid a ransom of nearly $300,000 in bitcoin to restore its systems that were affected in a ransomware attack on June 5, 2020. Investigations reveal that it was the act of DoppelPaymer operators.
- A database containing over 1.2 million user records from the multiplayer game, Stalker Online, was put up for sale on dark web forums. The leaked records included players’ usernames, passwords, email addresses, phone numbers, and IP addresses.
- Several websites belonging to different Australian financial institutions, law firms, and entertainment companies were put up for sale on MagBo underground forum. The access to these websites was sold at prices up to $10,000.
- The Sodinokibi ransomware operators leaked the files allegedly stolen from the U.K power grid company, Elexon, after the ransom demand wasn’t met. The firm was attacked in May 2020.
- Coincheck cryptocurrency exchange was hit in a cyberattack after hackers gained access to some emails sent by customers. These emails included names, dates of births, and phone numbers of customers.
- A new study found that around 80,000 printers are exposed online via the Internet Printing Protocol (IPP) port on a daily basis. This indicates that attackers can collect printers’ names, locations, models, and even organization names just scanning the IPP port.
- A multi-stage attack, distributed via a malicious Word document, disguised as a resume to users worldwide. In the last stage, the threat actors used Cobalt Strike’s Malleable C2 feature to download the final payload and perform C2 communication.
- Security researchers discovered two new malware NitroHack and Lucifer in different attack campaigns. While NitroHack modifies the Discord client for Windows into an infostealing trojan, Lucifer includes cryptocurrency and DDoS capabilities.
- The full impact of the newly discovered Ripple20 vulnerability, which arises due to a total of 19 flaws in the TCP/IP protocol from Treck, remains unclear. However, researchers believe that the healthcare sector is particularly affected by the flaw. It has been found that there are six times more vulnerable equipment used in healthcare than in other sectors.
- Three new ransomware, Hakbit, WastedLocker, and CryCryptor were detected by security experts in the last month. While Hakbit targeted mid-level executives across Austria, Switzerland, and Germany, WasteLocker is a creation of the EvilCorp hacker group. The CryCryptor ransomware was used to target Android users in Canada.
- The Ginp malware, which is well-known for targeting mobile banking customers in Spain, Poland, and the U.K, expanded its attack campaign to Turkey. Researchers found several fake web pages, mimicking banks in Turkey, designed to distribute the malware.
- Several U.S. energy providers were targeted by a new malware, dubbed FlowCloud, that gave the TA410 threat actor group total control over compromised devices. The attacks took place between July and November 2019 and the malware was pushed using malicious macros.
- Security experts discovered two new vulnerabilities, namely CrossTalk and SGAxe, affecting Intel processors. While the former affects some client and Intel Xeon E3 processors, the latter can be successfully used against devices using Intel’s 9th gen Coffee Lake Refresh processors.
- Valak malware enhanced its stealing capability with a new plugin called ‘clientgrabber.’ With this new addition, the malware can steal email credentials from the registry of a compromised machine.
- A new ransomware strain, named Tycoon, was found targeting Windows and Linux systems in a recent campaign. It deployed a trojanized Java Runtime Environment (JRE) to hide its malicious intentions. The malware is distributed via insecure internet-facing RDP servers.
- TrickBot operators used the new BazarBackdoor malware to gain full access to targeted networks. The newly discovered malware was distributed via spearphishing emails that leveraged employee termination notices, customer complaints, and other themes to trick recipients.
Posted on: July 01, 2020
Get the Monthly Threat Briefing delivered to your email!
More from Cyware
Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.
Explore Industry Briefs
Cyware for Enterprise
Adopt next-gen security with threat intelligence analysis, security automation...
Cyware for ISACs/ISAOs
Anticipate, prevent, and respond to threats through bi-directional threat in...