Share Blog Post
- Researchers at Carnegie Mellon University’s CyLab developed the fastest open source intrusion detection and prevention system (IDS/IPS) using a single five-processor core server and a field-programmable gate array (FPGA). Named Pigasus, the system is designed to demonstrate a more cost-effective approach to inspect internet traffic for malicious activities.
- Verisign’s research and development group developed new ways to authenticate and optimize DNS traffic on the client-side of the domain-name resolution process. It would, furthermore, allow organizations to filter out known bad actors and instead send them to a honeypot or deception decoy.
- The cyberworld witnessed a new development about the rollout of 5G wireless networks when the Government Accountability Office in the U.S. made recommendations that policymakers should consider the creation of cybersecurity standards to guarantee user safety and privacy.
- Baltimore County Public Schools suffered a ransomware attack, resulting in the shut down of all the schools. The attack crippled the school network system. However, the ransom money demanded has not been disclosed by the school authorities yet.
- Peatix users found themselves in hot water as soon as security experts discovered millions of records being circulated online. The breach at Peatix impacted the data of more than 4.2 million registered users, which were posted by threat actors via ads posted on Instagram stories, Telegram channels, and several other hacking forums.
- The decentralized finance protocol Pickle Finance found itself in quite a pickle recently when it was hacked and around $20 million in DAI tokens was drained off from its wallet. The attackers allegedly exploited the vulnerability in DAI PickleJar using fake swaps.
- The Campari Group fell victim to a new extortion scheme by the RagnarLocker ransomware gang and lost 2TB of files to the threat actors. The extortion scheme involved running Facebook ads to pressure victims into paying the ransom.
- The personal and health information of more than 16 million Brazilian COVID-19 patients were leaked online. This was caused by a hospital employee who uploaded a spreadsheet on GitHub containing usernames, passwords, and access keys to sensitive government systems.
- A database containing 8.3 million user records including personal information of 123RF was exposed on a hacker forum. The stolen data consisted of members’ full names, email addresses, MD5 hashed passwords, company name, phone number, address, PayPal emails, and IP addresses. However, no financial information was present in the database.
- Prestige Software, a Spain-based hotel booking software provider, exposed over 10 million log files dating back to 2013, due to a misconfigured Amazon S3 bucket. The leaked data included hotel guests’ full names, email addresses, contact details, national ID numbers, and, in some cases, even their payment information.
- Last month, American Bank Systems (ABS) and Managed.com were targeted in different ransomware attacks. While the attack on ABS resulted in the compromise of around 53GB of data, the attack on Managed.com impacted a limited number of its clients.
- Folksam accidentally leaked private data of about one million of its Swedish customers to tech giants such as Facebook, Google, Microsoft, and LinkedIn. The shared data included a wide variety of information of its customers.
- Luxottica disclosed a data breach that exposed the personal and health information of patients of LensCrafters, Target Optical, and EyeMed. In another camp, BigBasket, India’s largest online grocery delivery company, became a victim of a massive data breach. The leak contained a 15GB database of 20 million user records.
- The 100th version of the TrickBot malware was released with additional features to evade detection. With this release, TrickBot is now injecting DLL into the legitimate Windows executable, wermgr.exe, directly from memory using code from the MemoryModule project. Adding fuel to the fire, the gang released a new lightweight reconnaissance tool called LightBot.
- A new malware family called WAPDropper has been found stealthily targeting mobile phone users to subscribe to premium services. The multi-function dropper is delivered as second-stage malware and uses a machine learning solution to bypass image-based CAPTCHA challenges.
- A hacker has posted a list of one-line exploits to steal VPN credentials from almost 50,000 Fortinet VPN devices. The list of vulnerable targets include domains belonging to high-street banks and government organizations around the world.
- The threat landscape also witnessed the emergence of new Jupyter malware that stole information from its victims. The capabilities of the malware include collecting data from multiple applications such as popular web browsers and installing backdoors on targeted systems.
- A new mobile banking trojan, dubbed Ghimob, was found infecting mobile devices to target financial apps from banks, exchanges, and cryptocurrencies in Brazil, Paraguay, Peru, Portugal, Germany, Angola, and Mozambique.
- BlackBerry published details about CostaRicto, a new hacker-for-hire mercenary group that was discovered earlier this year. The group has launched attacks across different countries in the Americas, Europe, Australia, Asia, and Africa with victims located across South Asia, especially Singapore, India, and Bangladesh.
- Researchers observed an uptick in attacks from Pay2Key and WannaScream ransomware strains against Israeli companies. Hackers breached corporate networks, stole company data, encrypted files, and asked for huge payouts in exchange for decryption keys.
- Researchers reported a new Magecart threat group responsible for a series of attacks against e-commerce websites. Links to the unique skimmer, dubbed Ant and Cockroach, have been identified with Magecart group 12 via Svyaz, a Russian hosting provider that has hosted domains connected to the skimmer.
- A newly discovered worm and botnet called Gitpaste-12 was spotted exploiting GitHub for propagation and Pastebin for hosting malicious code. The malware comes equipped with reverse shell and cryptomining capabilities and exploits over 12 known vulnerabilities.
- A researcher demonstrated a new attack technique that enabled the remote access to any TCP/UDP port. Known as NAT Slipstreaming, the method involved sending a malicious link to targets that bypassed their firewall protection.
Posted on: December 02, 2020
Get the Monthly Threat Briefing delivered to your email!
More from Cyware
Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.
Explore Industry Briefs
Cyware for Enterprise
Adopt next-gen security with threat intelligence analysis, security automation...
Cyware for ISACs/ISAOs
Anticipate, prevent, and respond to threats through bi-directional threat in...