Share Blog post
- The Federal Bureau of Investigation (FBI) has released guidelines on defending against video teleconferencing (VTC) hijacking and Zoom-bombing attacks. The recommendations are proposed for those individuals and organizations that are increasingly dependent on VTC platforms like Zoom and Microsoft Teams.
- Japan’s Ministry of Defense has planned to invest a sum of $237 million in cybersecurity this year. A portion of this amount will be diverted towards an artificial intelligence-based system that can counter cyberattacks.
- Akamai, Amazon Web Services, Azion, Cloudflare, Facebook and Netflix have joined the Internet Society-backed Mutually Agreed Norms for Routing Security (MANRS) initiative that was launched six years ago. The program aims to advance the security and resiliency of the Internet’s routing infrastructure.
- Voter information of more than 4.9 million Georgians was affected after cybercriminals had put it on sale on a hacking forum. The information included full names, home addresses, dates of birth, ID numbers, and mobile numbers of individuals.
- Marriott International disclosed a data breach that impacted the personal information of about 5.2 million hotel guests. The breach had occurred after hackers gained unauthorized access to the login credentials of two employees at a franchise property.
- SOS Online Backup had inadvertently leaked over 135 million records last year due to a misconfigured database. The exposed information included full names, email addresses, phone numbers, internal company details, and account usernames of clients.
- The popular video-conferencing app, Zoom, came under fire for leaking personal information of at least a thousand users due to an issue in its settings. The bug resulted in the leak of users’ email addresses and photos.
- A spear-phishing attack on GoDaddy.com gave phishers the ability to view and modify key customer records. The incident had affected the domain settings for a half-dozen of its customers, including the transaction brokering site, escrow.com.
- A trove of 42 million records from a third-party app of Telegram was leaked through an Elasticsearch cluster targeted by a group called ‘Hunting system’. The exposed data included usernames, phone numbers, account IDs, hashes, and secret user keys.
- A new skimmer dubbed ‘MakeFrame’ compromised 19 different e-commerce websites to steal customers’ payment data. The attacks were attributed to Magecart Group 7.
- A hacker had managed to break into over 15000 Elasticsearch servers and defaced them as they were not protected with passwords.
- Researchers detected several COVID-19-themed attacks to infect users across the globe. One of these campaigns stole Microsoft login credentials, while another campaign distributed LokiBot trojan. A third campaign was also found distributing a new ‘BlueTea Action’ trojan.
- Several trojanized Zoom video conferencing apps available on different third-party stores were found infecting users’ devices with adware and trojan payloads. The primary purpose of these apps was to generate revenue for developers and steal information from users.
- Researchers identified an active Vollgar botnet campaign that targeted Microsoft SQL database servers for nearly two years. The campaign used brute-force attacks against MSSQL servers to gain admin access and later installed Monero cryptocurrency mining scripts.
- A complex cyberespionage that distributed a wide variety of malware such as XMRig, AZORult, a variant of Remcos RAT, and DarkVNC backdoor trojan, was uncovered by security experts. The infection chain began with a ZIP file that contained an ISO disk image file.
- All versions of Windows 10 are affected by over 25 potential vulnerabilities, out of which some can lead to elevation of privileges. The bugs impact the user interface win32 kernel component of Windows.
- DarkHotel APT group exploited two vulnerabilities in Firefox and Internet Explorer to launch attacks in Japan and China. The flaws were tracked as CVE-2019-17026 (in Firefox) and CVE-2020-0674 (in Internet Explorer).
- A watering hole attack campaign, active since May 2019, was found targeting people in a few Asian countries. The attackers’ toolset included Sojson obfuscation, NSIS installer, open-source code, Go language, and Google Drive-based C2 channels.
- Threat actors used Microsoft Excel spreadsheet’s VelvetSweatshop default password bug to deliver LimeRAT trojan. Once the trojan was launched on a victim’s system, it allowed the attackers to deliver ransomware, cryptominer, a keylogger and create a bot client.
- Vulnerabilities affecting Rank Math and Contact Form 7 Datepicker WordPress plugins could allow attackers to take over WordPress sites. These flaws have been patched with new versions of the plugins.
- Threat actors exploited two zero-day remote code execution vulnerabilities affecting some DrayTek router models to perform a series of attacks. These vulnerabilities existed in the /www/cgi-bin/mainfunction.cgi, and the corresponding Web Server program in /usr/sbin/lighttpd.
- Iranian government-backed hackers attempted to break into the personal email accounts of staff at the WHO during the coronavirus outbreak. The attack was conducted using malicious messages designed to mimic Google web services.
Posted on: April 03, 2020
Get the Weekly Threat Briefing delivered to your email!
More from Cyware
Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.