Share Blog Post
- The CISA unveiled its plans to work in tandem with internet service providers to obtain the personal data of their customers to warn them about existing vulnerabilities in their systems. Besides, the agency added two new Malware Analysis Reports (MARs) in its Mitigate Microsoft Exchange Server Vulnerabilities alert.
- The Spanish Police confiscated servers and arrested the developers of Mobdro, an Android app that entrapped smartphones into proxies and DDoS botnets.
- The U.S. Department of Justice (DOJ) indicted a Swiss national for attacking more than 100 organizations and publishing proprietary information on their online website. The department also confiscated the fifth domain faking the official site of Regeneron Pharmaceuticals involved in COVID-19 vaccine development.
- The CISA released a Python-based forensics collection tool, named CHIRP, to identify post-compromise malicious activity related to the SolarWinds hack.
- The FTC collaborated with nearly 40 U.S. states to put an end to a major charity fraud operation that scammed victims of more than $110 million via deceptive charitable fundraising calls.
- Backed by GCHQ, the National Cybersecurity Center, the U.K, has launched a new online self-assessment tool for micro-businesses and sole traders. Depending on the security posture of these businesses, the tool will advise on ways to enhance security.
- Scientists generated streams of entirely random numbers at approx. 100 times the speed of the fastest random number generator systems, using a single, chip-scale laser. This system can be utilized to generate cryptography keys.
- A Memorandum of Understanding was signed by CERT-EU and ENISA as an outcome of the Cybersecurity Act to detect and fortify the synergies between the two agencies. The collaboration is believed to build and strengthen the cybersecurity capabilities at the Union Level.
- Over 20TB and 800GB of sensitive data belonging to forex broker FBS and Ringostat, respectively, were leaked online due to unprotected Elasticsearch databases. In another vein, Descartes Aljex Software and Mariana Tek exposed millions of sensitive records due to misconfigured AWS S3 buckets.
- The Israeli Autumn threat actor took credit for leaking the registration and personal details—full names, phone numbers, ID card numbers—of millions of Israeli citizens.
- Honeywell, Sierra Wireless, and Oloron-Sainte-Marie hospital in Southwest France suffered various degrees of ransomware attacks, disrupting crucial operations and systems.
- World’s largest PC and device maker, Acer, has reportedly been targeted by the REvil ransomware gang who demanded $50 million in ransom to release the decryption key.
- A major cyberattack crippled the website of the Ministry of Defence academy, the U.K, in a state-sponsored attack, allegedly, conducted by Russian and Chinese hackers. An attack by Ryuk ransomware affected more than 700 government agencies across Spain.
- CompuCom informed its customers of a ransomware attack by DarkSide following the acquiring of admin credentials for the Office Depot subsidiary by the adversaries.
- Shell, Flagstar Bank, Qualys, the Norwegian Parliament, and the European Banking Authority became the victims of data breaches due to the compromise of Accellion’s File Transfer Appliance.
- Mimecast revealed that SolarWinds attackers broke into its internal network and downloaded source code and gained access to a subset of email addresses, salted and hashed credentials, and contact info.
- Video surveillance and AI security-based firm Verkada was breached by a member of the hacktivist group APT 69420 Arson Cats. Video feed from almost 150,000 cameras around the world was leaked.
- Several universities—The University of Central Lancashire, the University of Highlands, Queen’s University, and the University of Texas—were hit by a series of cyberattacks.
- The Russian-speaking Maza cybercriminal forum reportedly suffered a data breach leading to the leak of user data. In a similar incident, a threat actor leaked sensitive data from the now-defunct WeLeakInfo data breach site and published it on another hacker forum - RaidForums.
- A new version of Agent Tesla was spotted with the capability to steal information via HTTP, SMTP, or FTP. Speaking about upgraded variants, a new Purple Fox malware strain with worm capabilities was found to be deployed in an ongoing attack campaign. New variants of Phoenix CryptoLocker and Gafgyt botnet were responsible for attacking CNA and vulnerable D-Link and IoT devices, respectively. A new variant of Ryuk ransomware that includes self-propagation capabilities was uncovered by researchers.
- ZHtrap is a new IoT botnet that inherits functionalities from the infamous Mirai botnet. The botnet works by exploiting vulnerabilities in DVRs, CCTV cameras, Netgear routers, and Realtek devices.
- Threat actors are using Google Ads to distribute a fake version of the Telegram desktop app. Three links spoofing Telegram’s website have been detected so far. One of these sites was used to spread AZORult trojan.
- Security researchers have discovered a new type of steganography technique that involves hiding data inside a PNG image file posted on Twitter. Threat actors can exploit the method to obscure their nefarious activities on social media platforms.
- An espionage campaign, dubbed Operation Diànxùn, was identified by the McAfee Advanced Threat Research Strategic Intelligence team. Another cyberespionage campaign that distributes ObliqueRAT malware was traced by researchers.
- CopperStealer is an actively developed password and cookie stealer that targets the users of major service providers including Google, Facebook, Amazon, and Apple.
- A new sophisticated backdoor malware, dubbed RedXOR, has been found masquerading as a polkit daemon to target Linux endpoints and servers. In similar lines, XcodeSpy is a new malware that targets Xcode projects used in macOS to spread custom EggShell backdoors.
- The TA800 threat actor group was found distributing a malware loader called NimzaLoader in an ongoing highly-targeted spear-phishing email campaign. The Lazarus Group has been found using its MATA malware framework to deploy TFlower ransomware.
- A hybrid malware that includes both cryptominer and ransomware capabilities has hit 20,000 machines in the span of a few days. z0Miner botnet was upgraded to take control of Jenkins and Elasticsearch servers to mine Monero.
- Several new phishing campaigns came to the forefront, including attacks on the Coinbase platform to steal funds from cryptocurrency wallets. Scammers were found targeting investors in a sophisticated BEC scam with an average payout of $809,000 and another phishing campaign was impersonating the IRS to propagate the Dridex banking trojan.
- Research revealed that the SunCrypt ransomware shares similarities with QNAPCrypt ransomware. Three more malware strains—GoldMax, Sibot, and GoldFinder—related to the SolarWinds supply chain attack were discovered by Microsoft and FireEye.
- Time for some trojan news. The Ursnif Trojan was traced back to attacks against at least 100 banks in Italy. Threat actors are leveraging SEO techniques in the Gootloader technique to spread the Gootkit banking Trojan, Kronos, Cobalt Strike, and REvil ransomware.
Posted on: April 01, 2021
More from Cyware
Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.
Explore Industry Briefs
Cyware for Enterprise
Adopt next-gen security with threat intelligence analysis, security automation...
Cyware for ISACs/ISAOs
Anticipate, prevent, and respond to threats through bi-directional threat in...