Go to listing page

Cyware Weekly Threat Intelligence, August 26 - 30, 2019

Cyware Weekly Threat Intelligence, August 26 - 30, 2019

Share Blog Post

The Good

Let’s welcome the weekend by revisiting all that happened in cyberspace over the week. Before delving into the security incidents and new threats, let’s first take a look at all the positive events. The Governor of Louisiana has announced plans to establish a cyber facility named the ‘Louisiana Cyber Coordination Center (LC3). Google has announced the launch of the ‘Developer Data Protection Reward Program’ (DDPRP) and the expansion of the ‘Google Play Security Reward Program’ (GPSRP). Meanwhile, Microsoft is working on adding automatic phishing detection to enterprise in-org forms.

  • Google has announced a new bug bounty program named ‘Developer Data Protection Reward Program’ (DDPRP) through which researchers can report cases of abuse in Android apps, OAuth projects, and Chrome extensions. The tech giant has also announced the expansion of its ‘Google Play Security Rewards Program’ (GPSRP) to include all Android apps from the Google Play Store with over 100 million or more installs.
  • The Governor of Louisiana John Bel Edwards and Major General for the Louisiana National Guard Glenn Curtis have announced plans to establish a cyber facility named the ‘Louisiana Cyber Coordination Center (LC3)’. This facility will be established at the Water Campus in Baton Rouge.
  • The Australian government has extended the Consumer Data Right (CDR) to include the energy sector in order to ensure that the privacy of electricity consumers’ data is protected. In addition to this, the federal government has released a consultation paper to seek feedback on the data access model that will apply to the energy sector.
  • Microsoft is working on adding automatic phishing detection to enterprise in-org Microsoft forms. This will detect malicious password collection in forms and surveys. Automatic phishing detection for enterprise in-ord forms is expected to be rolled out in September 2019.

The Bad

Several data breaches and security incidents were witnessed in this week. Researchers have uncovered over 80 eCommerce websites that have been compromised by Magecart attackers. Web hosting provider Hostinger suffered a data breach compromising the personal information of over 14 million customers. Last but not least, Mastercard suffered a data breach after the customer data from its Priceless Specials loyalty program was leaked on the internet.

  • Hostinger has been hit with a data breach incident, that has impacted nearly 14 million customers. The data breach occurred after an unauthorized third party gained access to its internal API server. The compromised server contained clients’ first names, usernames, email addresses, hashed passwords, and IP addresses.
  • Mastercard suffered a security incident, exposing customers’ information on the internet after its Priceless Specials loyalty program was breached. The exposed information includes customers' names, dates of birth, gender, email addresses, phone numbers, home addresses, payment card numbers, and the time of first registration with Priceless Specials.
  • Lyons Companies, a leading insurance broker in Delaware, experienced a data breach incident compromising customers’ sensitive information. The compromised email accounts contained customers' names, dates of birth, contact information, driver's license information, financial information, medical record numbers, patient identification numbers, diagnosis and treatment information, and health insurance and claims information.
  • Imperva has disclosed that it suffered a data breach incident impacting the users of its Cloud Web Application Firewall (WAF) product, previously known as Incapsula. The data exposure has impacted a subset of customers of its WAF product who had accounts registered up until September 15, 2017. The exposed Incapsula customer database included email addresses and hashed and salted passwords. A few Incapsula customers also had their API keys and customer-provided SSL certificates exposed.
  • Security researchers have discovered that Magecart attackers have compromised over 80 eCommerce websites that were running an outdated version of Magento. 25% of these compromised websites are large brands in the motorsports industry and luxury retail.
  • A North Korean cyber-espionage group ‘Kimsuky’ has targeted several retired South Korean diplomats, military officials, and the members of South Korea's Foreign Ministry and Unification Ministry. The attacks occurred between mid-July and mid-August of 2019. They were basically carried out through spear-phishing emails that included links to fake login pages.
  • Hundreds of dental practice offices in the US had their data and patient records encrypted by Sodinokibi ransomware. On August 26, 2019, Sodinokibi aka Revil infected DDS Safe, an online backup product from Digital Dental Record (DDS), through its cloud management provider, PercSoft. Over 400 dental offices have been impacted by the ransomware attack.
  • ThaiCERT, ETDA, and a department in the Ministry of Digital for Economy and Society learned that Thai personal information has been found in foreign database systems of gambling websites. Following this, ThaiCERT examined the leaky database and found out that the database holds the personal information of over 41 million individuals including 3.3 million Thai citizens. The exposed information includes names, phone numbers, birthdays, ID card numbers, and bank account numbers.

New Threats

This week also witnessed the occurrence of several new malware strains and vulnerabilities. Researchers have uncovered a new version of Trickbot that includes new dynamic webinjects to steal PIN codes from Verizon Wireless, T-Mobile, and Sprint users. Researchers have found out malicious clickjacking scripts that intercept user clicks on at least 613 popular websites. Meanwhile, Apple released an update to the iOS 12.4 version to patch the jailbreak security flaw.

  • Secureworks Counter Threat Unit (CTU) researchers uncovered a new version of the Trickbot trojan that steals PIN codes from Verizon Wireless, T-Mobile, and Sprint users. CTU researchers monitored the TrickBot operations operated by the GOLD BLACKBURN threat group and uncovered that new dynamic webinjects were added to TrickBot to target mobile carriers in the US.
  • Researchers uncovered a new phishing campaign that distributes Quasar RAT onto Windows systems via fake resume attachments. Quasar RAT is capable of opening remote desktop connections, keylogging, stealing credentials, taking screenshots, recording video from webcams, downloading or exfiltrating files, and managing processes on infected machines.
  • Researchers have uncovered a new ransomware dubbed ‘Nemty ransomware’ that deletes the shadow or backup files in order to make it impossible for the victims to recover their files. Once the ransomware is installed and executed, it encrypts files of specific extensions and appends them with the .nemty extension.
  • Apple released an update to the iOS 12.4 version to patch a critical security flaw that allowed hackers to jailbreak up-to-date phones. The flaw could allow hackers to sneak in malicious apps that could execute arbitrary code with system privileges. Researchers have warned regular users who have not jailbroken their phones to update to the latest iOS 12.4.1 version
  • TA505 has been observed using ISO image attachments to distribute a new version of ServHelper and a DLL variant of FlawedAmmyy RAT. The group has also expanded its operations in new countries such as Turkey, Serbia, Romania, Korea, Canada, the Czech Republic, and Hungary.
  • Researchers from Microsoft Research, the Chinese University of Hong Kong, Seoul National University, and Pennsylvania State University have found out malicious clickjacking scripts that intercept user clicks on at least 613 popular websites. Researchers noted that while some of the scripts were used to intercept clicks and perform clicks on ads for generating ad revenue, other scripts were used to redirect users to malicious sites, tech support scams, and others.
  • Researchers noted that the popular “CamScanner” Android App which is downloaded by Android users over 100 million times, includes a malware component dubbed ‘Trojan-Dropper.AndroidOS.Necro.n’. Researchers recommend users to uninstall the app from their phones.
  • Lyceum, also known as Hexane is a threat actor group that targets critical infrastructure organizations such as oil and gas and telecommunications in the Middle East. The threat group relies on password spraying and brute-force attacks to compromise email accounts of targeted organizations’ employees. The malicious tools used by the group include DanaBot, Dandrop, Kl.ps1, Decrypt-RDCMan.ps1, and Get-LAPSP.ps1.
  • Antivirus maker Avast and the French National Gendarmerie have announced today that they've taken down the backend infrastructure of Retadup malware and have disinfected at least 85000 Windows systems.


 Tags

trickbot malware
automatic phishing detection
magecart attack
ta505 threat actor group
developer data protection reward program
jailbreak security flaw
google play security reward program
flawedammyy rat

Posted on: August 30, 2019


More from Cyware

Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.

The Virtual Cyber Fusion Suite