Go to listing page

Cyware Weekly Cyber Threat Intelligence April 23- 27, 2018

Cyware Weekly Cyber Threat Intelligence April 23- 27, 2018

Share Blog Post

The Good

The week witnessed some high points in cybersecurity with government agencies and firms making good strides towards addressing cyber threats. The Europol succeeded in dismantling the ‘Webstresser’ which it claimed to be a hotspot for the sale of DDoS attacks. Microsoft has launched 'Windows Defender System Guard' to mitigate attacks in software. On the other hand, researchers at New Zealand have invented the first ever quantum blockchain.  

  • Europol has successfully dismantled the Webstresser website. As per claims by the police, the website sold Distributed Denial of Service (DDoS) attacks and helped launch up to 6 million of them for as many as 136,000 registered users. The investigation was led by the Dutch National High Tech Crime Unit and the UK National Crime Agency (NCA), and assisted by Europol. Four alleged administrators of the site were arrested, the site was shut down and its infrastructure was seized.
  • A new Windows platform security technology, meant to mitigate attacks in software, has been released by Microsoft. The company announced Windows Defender System Guard runtime attestation that can provide signals for Endpoint Detection and Response (EDR) and antivirus vendors. The security technology is also capable of detecting kernel tampering, rootkits, and exploits.
  • A study by researchers in New Zealand found out that the newly proposed quantum blockchain can result in blockchain systems that are unaffected by quantum-computer hacking. This is considered to be the first ever fully quantum blockchain. This new quantum blockchain functions by interpreting its mistakes and influencing its own past.

The Bad

Along with the favorable news, the week noticed some disappointing breaches and attacks.  While Dubai-based ‘Careem’ app was affected by a data breach which resulted in data theft of 14 million users; ‘MyEtherWallet’, a web-based Ether wallet service suffered from the loss of cryptocurrencies due to DNS hijack. An unsecured Mongo database led to the data leak of 25,000 Bezop’s investors and 2 million UK bank customer faced trouble due to a faulty IT upgrade.

  • Dubai-based ride sharing platform Careem became a victim of data breach after a cyber attack resulted in the theft of personal data of up to 14 million people in the Middle East, North Africa, Pakistan and Turkey. The company announced that the breach was detected on January 14, post which, a thorough investigation was launched and leading security experts were engaged to strengthen security systems.
  • The DNS server of MyEtherWallet, a web-based Ether wallet service, was hijacked by unknown hackers in order to redirect users to a fake version of the website and steal their wallet private keys. Using these keys, hackers managed to steal close to 215 Ether (about $160,000 at the time of the transaction). Hackers could hijack the DNS entries by executing a BGP route hijack that redirected traffic meant for Amazon servers to systems they controlled.
  • Hackers managed to redirect Amazon traffic to rogue destinations for two hours by exploiting the Internet-protocol weakness. Roughly 1,300 IP addresses were hijacked in this charade. Attackers also masqueraded as cryptocurrency website MyEtherWallet.com and stole about $150,000.
  • Around 25,000 investors and potential investors linked with Bezop.io, the organization behind the Bezop cryptocurrency, had their personal details leaked due to an unsecured Mongo database. The personal information included names, addresses, encrypted passwords, wallet information, scanned passports, and copies of driver’s license. Bezop immediately secured the data after being notified.
  • Around two million UK banking customers experienced trouble using their accounts after an IT upgrade went wrong. Customers were also able to access other users’ savings and business accounts. The Financial Conduct Authority (FCA) and the Information Commissioner’s Office(ICO) are said to be investigating the incident.

New Threats

Talking about threats, researchers found Operation GhostSecret targeting global facilities and Rubella Macro Builder crimeware kit being used for campaign attacks. In other news, researchers unearthed Crossrider Variant and a new botnet family known as SquirtDanger was discovered.  

  • Dubbed Operation GhostSecret, a global data-stealing campaign has been discovered by McAfee security researchers, targeting several industries including critical infrastructure, entertainment, finance, health care, and telecommunications. The campaign leverages various tools, implants and malware variants associated with the Hidden Cobra hacker group.
  • A new variant of the Crossrider variant has been spotted attacking Mac devices disguising itself as a fake Adobe Flash Player installer. The configuration of the variant forces Safari and Chrome to redirect users to a page on chumsearch[dot]com. Unfortunately, this cannot be changed in the browser settings. The profile can be found by opening System Preferences, then clicking the Profiles icon.
  • Unit 42, Palo Alto Networks' threat research arm has discovered the author behind the new botnet malware family SquirtDanger. The Russian hacker, TheBottle, is found to be associated with these attacks. The malware is capable of conducting several actions including taking screenshots, clearing browsing cookies, steal stored information, upload/download files etc.
  • Three new malware variants associated with the APT34 hacker group have been discovered by a threat hunt team. The hacker group is believed to be operating since at least 2014, and uses BONDUPTATER (used to download software) and POWRUNER (used as a backdoor to exploit software vulnerabilities).
  • A new and advanced phishing kit, currently available in Brazil, is being analyzed by Check Point Researchers and a cyber intelligence company, CyberInt. The new kit is believed to be an epitome of the next generation in phishing architecture, as it makes for an even easier set-up and a more convincing fake website. The phishing kit generally targets online shoppers and aims at stealing users’ personal details and credit card information.
  • Members of the top-tier Russian hacking forum have started using the crimeware kit, dubbed the Rubella Macro Builder. The kit is cheap, fast and can bypass basic antivirus detections. The crimeware kit is being distributed via Microsoft Word or Excel email attachments.


rubella macro builder
operation ghostsecret

Posted on: April 27, 2018

More from Cyware

Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.