Sep 30, 2018

APT report for 2018-09-29

TRANSNATIONAL / UNKNOWN

Nothing to report

CHINA

  1. Long Term Security Attitudes and Practices Study
  2. CLOUDFLARE announces a domain name registration service, Cloudflare Registrar

INDIA

Nothing to report

NORTH KOREA

Nothing to report

PAKISTAN

Nothing to report

VIETNAM

Nothing to report

IRAN

Nothing to report

LEBANON

Nothing to report

PALESTINE

Nothing to report

SAUDI ARABIA

Nothing to report

UNITED ARAB EMIRATES

Nothing to report

RUSSIA

  1. Seven additional modules make Fancy Bear’s VPNFilter malware even more versatile

UKRAINE

Nothing to report

Platform report for 2018-09-29

WINDOWS

  1. Trustwave expert found 2 credential leak issues in Windows PureVPN Client

LINUX

  1. Linux Kernel Bug Surfaces, Allowing Root Access
  2. Google Project Zero Disclosed PoC & Exploit for Serious Linux Kernel Vulnerability

UNIX

Nothing to report

ANDROID

  1. Hide and seek Iot botnet updates include new Android ADB exploit
  2. Android password managers not as secure as desktop counterparts
  3. Beware!! New Android Malware That Can Read Your WhatsApp Messages & Take Screen Shots

IOS

Nothing to report

MACOS

Nothing to report

Threat report for 2018-09-29

DATA BREACH

  1. Telegram fixes IP address leak in desktop client
  2. UK Conservative Party conference app leaks MPs' personal details
  3. Telegram Leaks IP Addresses by Default When Initiating Calls
  4. Trustwave expert found 2 credential leak issues in Windows PureVPN Client
  5. Facebook Discloses Data Breach, 50 Million Accounts Affected
  6. Facebook data breach: 50 million users affected
  7. The @UN accidentally exposed credentials on public @trello boards. Plus, #Uber is set to pay $148 million settlement following its
  8. #Facebook Discloses Data Breach, 50 Million User Accounts Affected https://tripwire.me/2NQrPfW via@ritzsanti

DENIAL-OF-SERVICE

  1. Torii botnet, probably the most sophisticated IoT botnet of ever
  2. Torii malware could be gateway to more sophisticated IoT botnet attacks
  3. Hide and seek Iot botnet updates include new Android ADB exploit

MALVERTISING

Nothing to report

PHISHING

  1. Chegg Forces Password Reset On 40 Million Users
  2. Can the @Microsoft Authenticator really replace passwords in the enterprise? Microsoft says the answer is yes and proclaimed the password
  3. Android password managers not as secure as desktop counterparts

WEB DEFACEMENT

Nothing to report

MALWARE

  1. Telegram fixes IP address leak in desktop client
  2. Telegram Leaks IP Addresses by Default When Initiating Calls
  3. Malicious Hackers Increasing the Exploitation of RDP Protocol to Hack the Targeted Victims
  4. Defeating Polymorphic Malware with Cognitive Intelligence. Part 2: Command Line Argument Clustering
  5. Pirated Game of Thrones episodes most popular TV bait for malware
  6. Seven additional modules make Fancy Bear’s VPNFilter malware even more versatile
  7. Can monitoring help defend against #Sanny #malware update?
  8. Torii malware could be gateway to more sophisticated IoT botnet attacks
  9. VirusTotal slips on biz suit, says Google's daddy will help the search for nasties
  10. Ransomware Crypto-Locks Port of San Diego IT Systems
  11. Port of San Diego Suffers Ransomware Attack
  12. Beware!! New Android Malware That Can Read Your WhatsApp Messages & Take Screen Shots
  13. Malware in the Cloud: What You Need to Know
  14. Pirated episodes of Game of Thrones, the most popular malware bait
  15. CLOUDFLARE announces a domain name registration service, Cloudflare Registrar
  16. Port of San Diego Suffers Ransomware Attack
  17. Alphabet's @chroniclesec unveiled #VirusTotal Enterprise, a new version of the file scanning service designed specifically for enterprise customers. By @RobWright22

EXPLOIT

  1. Malicious Hackers Increasing the Exploitation of RDP Protocol to Hack the Targeted Victims
  2. Hide and seek Iot botnet updates include new Android ADB exploit
  3. Google Project Zero Disclosed PoC & Exploit for Serious Linux Kernel Vulnerability
  4. Hackers Exploited Facebook Zero-Day Flaw & Stolen 50 Million Accounts Access Tokens
  5. Tripwire Patch Priority Index for September 2018

VULNERABILITY

  1. Linux Kernel Bug Surfaces, Allowing Root Access
  2. Google Project Zero Disclosed PoC & Exploit for Serious Linux Kernel Vulnerability
  3. How a vulnerability in #strongSwan caused a buffer underflow
  4. Vulnerability discovered in WiFi routers
  5. Hackers Exploited Facebook Zero-Day Flaw & Stolen 50 Million Accounts Access Tokens

Region brief for 2018-09-29

ASIA

  1. India’s Banking Cybersecurity Woes

OCEANIA

Nothing to report

NORTH AMERICA

  1. Long Term Security Attitudes and Practices Study
  2. CLOUDFLARE announces a domain name registration service, Cloudflare Registrar

SOUTH AMERICA

Nothing to report

EUROPE

  1. Torii botnet, probably the most sophisticated IoT botnet of ever
  2. UK Conservative Party conference app leaks MPs' personal details

AFRICA

Nothing to report

Sector brief for 2018-09-29

HEALTHCARE

Nothing to report

TRANSPORT

  1. India’s Banking Cybersecurity Woes
  2. Ransomware Crypto-Locks Port of San Diego IT Systems
  3. Port of San Diego Suffers Ransomware Attack
  4. Port of San Diego Suffers Ransomware Attack

BANKING & FINANCE

  1. India’s Banking Cybersecurity Woes
  2. Vulnerability discovered in WiFi routers

INFORMATION & TELECOMMUNICATION

Nothing to report

FOOD

Nothing to report

WATER

Nothing to report

ENERGY

Nothing to report

GOVERNMENT & PUBLIC SERVICE

Nothing to report

Daily brief for 2018-09-29

ASIA

  1. India’s Banking Cybersecurity Woes

WORLD

  1. Long Term Security Attitudes and Practices Study
  2. Torii botnet, probably the most sophisticated IoT botnet of ever
  3. UK Conservative Party conference app leaks MPs' personal details
  4. CLOUDFLARE announces a domain name registration service, Cloudflare Registrar

ATTACKS

  1. Telegram fixes IP address leak in desktop client
  2. Torii botnet, probably the most sophisticated IoT botnet of ever
  3. UK Conservative Party conference app leaks MPs' personal details
  4. Chegg Forces Password Reset On 40 Million Users
  5. Telegram Leaks IP Addresses by Default When Initiating Calls
  6. Can the @Microsoft Authenticator really replace passwords in the enterprise? Microsoft says the answer is yes and proclaimed the password
  7. Trustwave expert found 2 credential leak issues in Windows PureVPN Client
  8. Torii malware could be gateway to more sophisticated IoT botnet attacks
  9. Hide and seek Iot botnet updates include new Android ADB exploit
  10. Android password managers not as secure as desktop counterparts
  11. Facebook Discloses Data Breach, 50 Million Accounts Affected
  12. Facebook data breach: 50 million users affected
  13. The @UN accidentally exposed credentials on public @trello boards. Plus, #Uber is set to pay $148 million settlement following its
  14. #Facebook Discloses Data Breach, 50 Million User Accounts Affected https://tripwire.me/2NQrPfW via@ritzsanti

THREATS

  1. Telegram fixes IP address leak in desktop client
  2. Linux Kernel Bug Surfaces, Allowing Root Access
  3. Telegram Leaks IP Addresses by Default When Initiating Calls
  4. Malicious Hackers Increasing the Exploitation of RDP Protocol to Hack the Targeted Victims
  5. Defeating Polymorphic Malware with Cognitive Intelligence. Part 2: Command Line Argument Clustering
  6. Pirated Game of Thrones episodes most popular TV bait for malware
  7. Seven additional modules make Fancy Bear’s VPNFilter malware even more versatile
  8. Can monitoring help defend against #Sanny #malware update?
  9. Torii malware could be gateway to more sophisticated IoT botnet attacks
  10. VirusTotal slips on biz suit, says Google's daddy will help the search for nasties
  11. Ransomware Crypto-Locks Port of San Diego IT Systems
  12. Hide and seek Iot botnet updates include new Android ADB exploit
  13. Google Project Zero Disclosed PoC & Exploit for Serious Linux Kernel Vulnerability
  14. Port of San Diego Suffers Ransomware Attack
  15. How a vulnerability in #strongSwan caused a buffer underflow
  16. Beware!! New Android Malware That Can Read Your WhatsApp Messages & Take Screen Shots
  17. Malware in the Cloud: What You Need to Know
  18. Vulnerability discovered in WiFi routers
  19. Pirated episodes of Game of Thrones, the most popular malware bait
  20. CLOUDFLARE announces a domain name registration service, Cloudflare Registrar
  21. Hackers Exploited Facebook Zero-Day Flaw & Stolen 50 Million Accounts Access Tokens
  22. Tripwire Patch Priority Index for September 2018
  23. Port of San Diego Suffers Ransomware Attack
  24. Alphabet's @chroniclesec unveiled #VirusTotal Enterprise, a new version of the file scanning service designed specifically for enterprise customers. By @RobWright22

CRIME

  1. India’s Banking Cybersecurity Woes
  2. Ransomware Crypto-Locks Port of San Diego IT Systems
  3. Vulnerability discovered in WiFi routers

POLITICS

Nothing to report

Sep 29, 2018

APT report for 2018-09-28

TRANSNATIONAL / UNKNOWN

  1. Magecart campaign remains active

CHINA

Nothing to report

INDIA

Nothing to report

NORTH KOREA

Nothing to report

PAKISTAN

Nothing to report

VIETNAM

Nothing to report

IRAN

Nothing to report

LEBANON

Nothing to report

PALESTINE

Nothing to report

SAUDI ARABIA

Nothing to report

UNITED ARAB EMIRATES

Nothing to report

RUSSIA

  1. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  2. Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
  3. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
  4. Fancy Bear still Putin out new modules for VPNFilter malware
  5. Google first confirmed the existence of the Dragonfly program for returning to China

UKRAINE

Nothing to report

Platform report for 2018-09-28

WINDOWS

  1. Vulnerabilities in PureVPN Client Leak User Credentials
  2. Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
  3. Windows 10 security: Here's how we're hitting back at fileless malware, says Microsoft
  4. Microsoft is trying to kill passwords in Azure AD application

LINUX

  1. Another Linux Kernel Bug Surfaces, Allowing Root Access
  2. 'Mutagen Astronomy' Linux kernel vulnerability sighted
  3. CVE-2018-1718 -Google Project Zero reports a new Linux Kernel flaw
  4. Google Project Zero Discloses New Linux Kernel Flaw
  5. Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit

UNIX

Nothing to report

ANDROID

  1. Another Linux Kernel Bug Surfaces, Allowing Root Access
  2. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
  3. Android App Verification Issues Pave Way For Phishing Attacks
  4. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
  5. Hide 'N Seek IoT Botnet Now Targets Android Devices
  6. Android password managers vulnerable to phishing apps
  7. Android password managers not as secure as desktop counterparts
  8. CVE-2018-1718 -Google Project Zero reports a new Linux Kernel flaw
  9. Google Play Store Swarmed with Malware
  10. Google first confirmed the existence of the Dragonfly program for returning to China

IOS

Nothing to report

MACOS

Nothing to report

Threat report for 2018-09-28

DATA BREACH

  1. Facebook leaks data (including private conversations) from 50 million accounts
  2. Facebook leaks data (including private conversations) from 50 million accounts
  3. Facebook hacked – 50 Million Users’ Data exposed in the security breach
  4. Big Facebook data breach: 50 million accounts affected
  5. Facebook Data Breach Impacts Almost 50 Million Accounts
  6. Vulnerabilities in PureVPN Client Leak User Credentials
  7. New Phishing Campaign Targets US Employees' Online Payrolls
  8. 3 GOP senators doxed during Kavanaugh hearing
  9. Chegg Resets Passwords After Data Breach That Affected 40 Million Users
  10. Facebook Discloses Data Breach, 50 Million User Accounts Affected
  11. United Nations data found exposed on web: researcher
  12. Magecart campaign remains active
  13. “Firefox Monitor” will allow users to check whether their personal information and passwords have been part of a data breach
  14. Bupa fined £175,000 for 2017 data breach affecting 547,000 customers
  15. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
  16. United Nations data found exposed on web: researcher
  17. How can live chat widgets leak personal employee data?
  18. Chegg Data Breach Affects 40 Million Customers

DENIAL-OF-SERVICE

  1. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
  2. Torii malware could be gateway to more sophisticated IoT botnet attacks
  3. Meet Torii, a Stealthy, Versatile and Highly Persistent IoT Botnet
  4. Hide 'N Seek IoT Botnet Now Targets Android Devices
  5. Who’s behind DDoS attacks at UK universities?
  6. Stealthy and Persistent Torii IoT Botnet Infects Devices via Telnet
  7. Meet Torii, a new IoT botnet far more sophisticated than Mirai variants
  8. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai
  9. Phorpiex bots target remote access servers to deliver ransomware
  10. New Iot Botnet Torii Uses Six Methods for Persistence, Has No Clear Purpose
  11. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai

MALVERTISING

Nothing to report

PHISHING

  1. Aspire Health, Another Healthcare Firm as a Phishing Victim
  2. New Phishing Campaign Targets US Employees' Online Payrolls
  3. Learn how our @PhishingAI successfully detected a custom #phishing kit targeted at the DNC last month:
  4. Chegg forces password reset on 40 million users
  5. SHEIN breach exposes emails, encrypted passwords of 6.42M customers
  6. Do you know the top myths and facts of #mobile #phishing? If not, don't worry, we've compiled a list of
  7. Android App Verification Issues Pave Way For Phishing Attacks
  8. Facebook Resets 90 Million User Passwords as Flaw is Discovered
  9. Facebook Resets 90 Million User Passwords as Flaw is Discovered
  10. Chegg Resets Passwords After Data Breach That Affected 40 Million Users
  11. Android password managers vulnerable to phishing apps
  12. “Firefox Monitor” will allow users to check whether their personal information and passwords have been part of a data breach
  13. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
  14. Power to the people! Google backtracks (a bit) on forced Chrome logins
  15. Microsoft is trying to kill passwords in Azure AD application
  16. Android password managers not as secure as desktop counterparts
  17. 7 Most Prevalent Phishing Subject Lines

WEB DEFACEMENT

Nothing to report

MALWARE

  1. Port of San Diego suffers ransomware attack | Avast
  2. Port of San Diego suffers ransomware attack | Avast
  3. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  4. Zoho Was Blacklisted by Domain Registrar TierraNet
  5. The Week in Ransomware - September 28th 2018 - RDP and gandCrab
  6. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
  7. 'Torii' Breaks New Ground For IoT Malware
  8. Port of San Diego, The Newest Victim of Ransomware Attack
  9. Powerful Ransomware Attack Hit on Port of San Diego
  10. Torii malware could be gateway to more sophisticated IoT botnet attacks
  11. Docs reveal how Fruitfly Mac spyware initially spread
  12. Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
  13. FBI solves mystery surrounding 15-year-old Fruitfly Mac malware
  14. USB malware and cryptominers are threat to emerging markets
  15. Potential Misuse of Legitimate Websites to Avoid Malware Detection
  16. Port of San Diego Suffers Ransomware Attack
  17. Delphi Packer Increasingly Used to Evade Malware Classification
  18. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
  19. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
  20. Port of San Diego Hit by Ransomware
  21. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
  22. Windows 10 security: Here's how we're hitting back at fileless malware, says Microsoft
  23. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)
  24. Sunny Cali goes ballistic, this ransomware is atrocious. Even our IT bill will be something quite ferocious
  25. Fancy Bear still Putin out new modules for VPNFilter malware
  26. How Data Security Improves When You Engage Employees in the Process
  27. Users Clicking Through Warnings, Leading to RAT Infections
  28. Google Play Store Swarmed with Malware
  29. Phorpiex bots target remote access servers to deliver ransomware
  30. Port of San Diego Suffers Ransomware Attack
  31. ICS Cybersecurity: Visibility, Protective Controls & Continuous Monitoring
  32. ICS Cybersecurity: Visibility, Protective Controls & Continuous Monitoring

EXPLOIT

  1. Tripwire Patch Priority Index for September 2018
  2. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
  3. Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit

VULNERABILITY

  1. CVE-2018-11776 RCE Flaw in Apache Struts Could Be Root Cause of Clamorous Hacks
  2. Critical Security Vulnerability in Facebook Affects 50 million Users!
  3. Facebook Security Bug Affects 90M Users
  4. [SingCERT] Alert on 14 High-Severity Vulnerabilities in Cisco Products
  5. Another Linux Kernel Bug Surfaces, Allowing Root Access
  6. Vulnerabilities in PureVPN Client Leak User Credentials
  7. FBI IC3 Warns of RDP Vulnerability
  8. Facebook Vulnerability Affecting 50 Million Users Allowed Account Takeover
  9. Facebook Resets 90 Million User Passwords as Flaw is Discovered
  10. Facebook Resets 90 Million User Passwords as Flaw is Discovered
  11. Hackers Stole 50 Million Facebook Users' Access Tokens Using Zero-Day Flaw
  12. Researchers: 11-Year-Old Flaw in Vote Scanner Still Unfixed
  13. Facebook: 50 million accounts impacted by security flaw
  14. 'Mutagen Astronomy' Linux kernel vulnerability sighted
  15. SECURITY UPDATE: Facebook said a breach affected 50 million people on the social network. The vulnerability stemmed from Facebook's "View As"
  16. Connected car cyber-security getting better, fewer critical vulnerabilities found
  17. No Patches for Critical Flaws in Fuji Electric Servo System, Drives
  18. CVE-2018-1718 -Google Project Zero reports a new Linux Kernel flaw
  19. Vulnerabilities and architectural considerations in industrial control systems
  20. Google Project Zero Discloses New Linux Kernel Flaw
  21. Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit
  22. Tripwire Patch Priority Index for September 2018

Region brief for 2018-09-28

ASIA

  1. No Patches for Critical Flaws in Fuji Electric Servo System, Drives
  2. Google first confirmed the existence of the Dragonfly program for returning to China

OCEANIA

Nothing to report

NORTH AMERICA

  1. Facebook leaks data (including private conversations) from 50 million accounts
  2. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  3. Aspire Health, Another Healthcare Firm as a Phishing Victim
  4. New Phishing Campaign Targets US Employees' Online Payrolls
  5. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
  6. Researchers: 11-Year-Old Flaw in Vote Scanner Still Unfixed
  7. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
  8. Vulnerabilities and architectural considerations in industrial control systems

SOUTH AMERICA

Nothing to report

EUROPE

  1. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  2. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
  3. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
  4. Magecart campaign remains active
  5. Who’s behind DDoS attacks at UK universities?
  6. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)

AFRICA

Nothing to report

Sector brief for 2018-09-28

HEALTHCARE

  1. Aspire Health, Another Healthcare Firm as a Phishing Victim
  2. New Phishing Campaign Targets US Employees' Online Payrolls

TRANSPORT

  1. Port of San Diego suffers ransomware attack | Avast
  2. Port of San Diego suffers ransomware attack | Avast
  3. Port of San Diego, The Newest Victim of Ransomware Attack
  4. Powerful Ransomware Attack Hit on Port of San Diego
  5. Port of San Diego Suffers Ransomware Attack
  6. Port of San Diego Hit by Ransomware
  7. Port of San Diego Suffers Ransomware Attack

BANKING & FINANCE

  1. New Phishing Campaign Targets US Employees' Online Payrolls
  2. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
  3. Magecart campaign remains active

INFORMATION & TELECOMMUNICATION

Nothing to report

FOOD

Nothing to report

WATER

Nothing to report

ENERGY

Nothing to report

GOVERNMENT & PUBLIC SERVICE

  1. Facebook leaks data (including private conversations) from 50 million accounts
  2. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  3. New Phishing Campaign Targets US Employees' Online Payrolls

Daily brief for 2018-09-28

ASIA

  1. No Patches for Critical Flaws in Fuji Electric Servo System, Drives
  2. Google first confirmed the existence of the Dragonfly program for returning to China

WORLD

  1. Facebook leaks data (including private conversations) from 50 million accounts
  2. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  3. Aspire Health, Another Healthcare Firm as a Phishing Victim
  4. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
  5. New Phishing Campaign Targets US Employees' Online Payrolls
  6. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
  7. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
  8. Magecart campaign remains active
  9. Researchers: 11-Year-Old Flaw in Vote Scanner Still Unfixed
  10. Who’s behind DDoS attacks at UK universities?
  11. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
  12. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)
  13. Vulnerabilities and architectural considerations in industrial control systems

ATTACKS

  1. Facebook leaks data (including private conversations) from 50 million accounts
  2. Facebook leaks data (including private conversations) from 50 million accounts
  3. Facebook hacked – 50 Million Users’ Data exposed in the security breach
  4. Big Facebook data breach: 50 million accounts affected
  5. Facebook Data Breach Impacts Almost 50 Million Accounts
  6. Vulnerabilities in PureVPN Client Leak User Credentials
  7. Aspire Health, Another Healthcare Firm as a Phishing Victim
  8. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
  9. New Phishing Campaign Targets US Employees' Online Payrolls
  10. Learn how our @PhishingAI successfully detected a custom #phishing kit targeted at the DNC last month:
  11. 3 GOP senators doxed during Kavanaugh hearing
  12. Chegg forces password reset on 40 million users
  13. Torii malware could be gateway to more sophisticated IoT botnet attacks
  14. SHEIN breach exposes emails, encrypted passwords of 6.42M customers
  15. Do you know the top myths and facts of #mobile #phishing? If not, don't worry, we've compiled a list of
  16. Android App Verification Issues Pave Way For Phishing Attacks
  17. Facebook Resets 90 Million User Passwords as Flaw is Discovered
  18. Facebook Resets 90 Million User Passwords as Flaw is Discovered
  19. Meet Torii, a Stealthy, Versatile and Highly Persistent IoT Botnet
  20. Chegg Resets Passwords After Data Breach That Affected 40 Million Users
  21. Facebook Discloses Data Breach, 50 Million User Accounts Affected
  22. United Nations data found exposed on web: researcher
  23. Hide 'N Seek IoT Botnet Now Targets Android Devices
  24. Magecart campaign remains active
  25. Android password managers vulnerable to phishing apps
  26. “Firefox Monitor” will allow users to check whether their personal information and passwords have been part of a data breach
  27. Bupa fined £175,000 for 2017 data breach affecting 547,000 customers
  28. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
  29. Power to the people! Google backtracks (a bit) on forced Chrome logins
  30. Who’s behind DDoS attacks at UK universities?
  31. Microsoft is trying to kill passwords in Azure AD application
  32. Android password managers not as secure as desktop counterparts
  33. Stealthy and Persistent Torii IoT Botnet Infects Devices via Telnet
  34. United Nations data found exposed on web: researcher
  35. Meet Torii, a new IoT botnet far more sophisticated than Mirai variants
  36. How can live chat widgets leak personal employee data?
  37. Chegg Data Breach Affects 40 Million Customers
  38. 7 Most Prevalent Phishing Subject Lines
  39. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai
  40. Phorpiex bots target remote access servers to deliver ransomware
  41. New Iot Botnet Torii Uses Six Methods for Persistence, Has No Clear Purpose
  42. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai

THREATS

  1. CVE-2018-11776 RCE Flaw in Apache Struts Could Be Root Cause of Clamorous Hacks
  2. Port of San Diego suffers ransomware attack | Avast
  3. Port of San Diego suffers ransomware attack | Avast
  4. Critical Security Vulnerability in Facebook Affects 50 million Users!
  5. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  6. Facebook Security Bug Affects 90M Users
  7. Zoho Was Blacklisted by Domain Registrar TierraNet
  8. [SingCERT] Alert on 14 High-Severity Vulnerabilities in Cisco Products
  9. Another Linux Kernel Bug Surfaces, Allowing Root Access
  10. Vulnerabilities in PureVPN Client Leak User Credentials
  11. The Week in Ransomware - September 28th 2018 - RDP and gandCrab
  12. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
  13. 'Torii' Breaks New Ground For IoT Malware
  14. FBI IC3 Warns of RDP Vulnerability
  15. Tripwire Patch Priority Index for September 2018
  16. Port of San Diego, The Newest Victim of Ransomware Attack
  17. Powerful Ransomware Attack Hit on Port of San Diego
  18. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
  19. Torii malware could be gateway to more sophisticated IoT botnet attacks
  20. Docs reveal how Fruitfly Mac spyware initially spread
  21. Facebook Vulnerability Affecting 50 Million Users Allowed Account Takeover
  22. Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
  23. FBI solves mystery surrounding 15-year-old Fruitfly Mac malware
  24. USB malware and cryptominers are threat to emerging markets
  25. Facebook Resets 90 Million User Passwords as Flaw is Discovered
  26. Potential Misuse of Legitimate Websites to Avoid Malware Detection
  27. Facebook Resets 90 Million User Passwords as Flaw is Discovered
  28. Port of San Diego Suffers Ransomware Attack
  29. Delphi Packer Increasingly Used to Evade Malware Classification
  30. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
  31. Hackers Stole 50 Million Facebook Users' Access Tokens Using Zero-Day Flaw
  32. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
  33. Researchers: 11-Year-Old Flaw in Vote Scanner Still Unfixed
  34. Port of San Diego Hit by Ransomware
  35. Facebook: 50 million accounts impacted by security flaw
  36. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
  37. Windows 10 security: Here's how we're hitting back at fileless malware, says Microsoft
  38. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)
  39. Sunny Cali goes ballistic, this ransomware is atrocious. Even our IT bill will be something quite ferocious
  40. Fancy Bear still Putin out new modules for VPNFilter malware
  41. 'Mutagen Astronomy' Linux kernel vulnerability sighted
  42. How Data Security Improves When You Engage Employees in the Process
  43. SECURITY UPDATE: Facebook said a breach affected 50 million people on the social network. The vulnerability stemmed from Facebook's "View As"
  44. Connected car cyber-security getting better, fewer critical vulnerabilities found
  45. Users Clicking Through Warnings, Leading to RAT Infections
  46. No Patches for Critical Flaws in Fuji Electric Servo System, Drives
  47. CVE-2018-1718 -Google Project Zero reports a new Linux Kernel flaw
  48. Google Play Store Swarmed with Malware
  49. Phorpiex bots target remote access servers to deliver ransomware
  50. Vulnerabilities and architectural considerations in industrial control systems
  51. Google Project Zero Discloses New Linux Kernel Flaw
  52. Port of San Diego Suffers Ransomware Attack
  53. ICS Cybersecurity: Visibility, Protective Controls & Continuous Monitoring
  54. Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit
  55. Tripwire Patch Priority Index for September 2018
  56. ICS Cybersecurity: Visibility, Protective Controls & Continuous Monitoring

CRIME

  1. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  2. Aspire Health, Another Healthcare Firm as a Phishing Victim
  3. New Phishing Campaign Targets US Employees' Online Payrolls
  4. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
  5. Potential Misuse of Legitimate Websites to Avoid Malware Detection
  6. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
  7. Magecart campaign remains active
  8. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
  9. Stealthy and Persistent Torii IoT Botnet Infects Devices via Telnet

POLITICS

  1. Facebook leaks data (including private conversations) from 50 million accounts
  2. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  3. Aspire Health, Another Healthcare Firm as a Phishing Victim
  4. Hackers Stole 50 Million Facebook Users' Access Tokens Using Zero-Day Flaw
  5. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)

Sep 28, 2018

APT report for 2018-09-27

TRANSNATIONAL / UNKNOWN

  1. Threat-group Magecart - More Victims
  2. Europol Highlights Continued Threats, but Magecart Demands Focus on Web Security

CHINA

  1. APT10 Targeting Japanese Corporations Using Updated TTPs

INDIA

Nothing to report

NORTH KOREA

Nothing to report

PAKISTAN

Nothing to report

VIETNAM

Nothing to report

IRAN

Nothing to report

LEBANON

Nothing to report

PALESTINE

Nothing to report

SAUDI ARABIA

Nothing to report

UNITED ARAB EMIRATES

Nothing to report

RUSSIA

  1. APT Group Uses Dangerous LoJax Malware That Can Survive After OS Re-installation and Hard Disk Replacement
  2. Russians' stealthy 'LoJax' malware can infect on the firmware level
  3. Seven additional modules make Fancy Bear’s VPNFilter malware even more versatile
  4. Russian Cyberspies Use UEFI Rootkit in Attacks
  5. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  6. LoJax: First-ever UEFI rootkit detected in a cyberattack
  7. Cybersecurity Researchers Spotted First-Ever UEFI Rootkit in the Wild
  8. Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild
  9. Seven additional modules make Fancy Bear's VPNFilter malware even more versatile
  10. APT28 Uses LoJax, First UEFI Rootkit Seen in the Wild
  11. VPNFilter Router Malware Adds 7 New Network Exploitation Modules
  12. “Disturbing plans” in China revealed by a former Google employee

UKRAINE

Nothing to report

Platform report for 2018-09-27

WINDOWS

  1. The PowerShell Boogeyman: How to Defend Against Malicious PowerShell Attacks
  2. Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
  3. Is There Such a Thing as a Malicious PowerShell Command?

LINUX

  1. Local-Privilege Escalation Flaw in Linux Kernel Allows Root Access
  2. Cisco unearths 13 'High Impact' IOS vulnerabilities you need to patch now
  3. Mutagen Astronomy Linux Kernel vulnerability affects Red Hat, CentOS, and Debian distros

UNIX

Nothing to report

ANDROID

  1. Hide and Seek (HNS) IoT Botnet targets Android devices with ADB option enabled
  2. Android password managers not as secure as desktop counterparts
  3. Hide and seek Iot botnet updates include new Android ADB exploit
  4. Hide and seek Iot botnet updates include new Android ADB exploit

IOS

  1. Cisco unearths 13 'High Impact' IOS vulnerabilities you need to patch now

MACOS

  1. ex-NSA Hacker Discloses macOS Mojave 10.14 Zero-Day Vulnerability

Threat report for 2018-09-27

DATA BREACH

  1. Twitter Bug May Have Exposed Millions of DMs
  2. GDPR: Data Breach Class Action Lawsuits Come to Europe
  3. Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild
  4. SheIn Data Breach Exposed Personal Details 6.4 Million Customers To Hackers
  5. United Nations data found exposed on web: researcher
  6. New GootKit Campaigns Target European Banks with Reconnaissance Attacks
  7. Uber to Pay $148 Million as a Settlement for Data Breach Cover
  8. Uber fined $148m for data breach cover-up
  9. You should prepare for the next mega data breach
  10. Uber agrees to pay $148 million in massive 2016 data breach settlement
  11. Endace launches petabyte network recording appliance

DENIAL-OF-SERVICE

  1. Hide and Seek (HNS) IoT Botnet targets Android devices with ADB option enabled
  2. Hide and seek Iot botnet updates include new Android ADB exploit
  3. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai
  4. DDoS attack on education vendor hinders access to districts’ online portals
  5. New Torii Botnet uncovered, more sophisticated than Mirai | Avast
  6. Hide and seek Iot botnet updates include new Android ADB exploit
  7. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai

MALVERTISING

Nothing to report

PHISHING

  1. Android password managers not as secure as desktop counterparts
  2. Boffins bypass password protection with pilfering by phony programs
  3. Are long passphrases the answer to password problems?
  4. Chrome 70 will resolve cookies and login privacy issues

WEB DEFACEMENT

Nothing to report

MALWARE

  1. APT Group Uses Dangerous LoJax Malware That Can Survive After OS Re-installation and Hard Disk Replacement
  2. Russians' stealthy 'LoJax' malware can infect on the firmware level
  3. CCSP Exam Details and Process
  4. CCSP: Overview of Domains
  5. Ransomware Attack Hits Port of San Diego
  6. The PowerShell Boogeyman: How to Defend Against Malicious PowerShell Attacks
  7. Chronicle Unveils VirusTotal Enterprise
  8. Crooks turn to Delphi packers to evade malware detection
  9. Chronicle announces VirusTotal Enterprise with greater search and analysis capabilities
  10. Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
  11. Alphabet launches VirusTotal Enterprise
  12. Is There Such a Thing as a Malicious PowerShell Command?
  13. New KONNI Malware attacking Eurasia and Southeast Asia
  14. New KONNI Malware attacking Eurasia and Southeast Asia
  15. Pirated Game of Thrones episodes most popular TV bait for malware
  16. Seven additional modules make Fancy Bear’s VPNFilter malware even more versatile
  17. Russian Cyberspies Use UEFI Rootkit in Attacks
  18. Dirhunt – Search and Analyze Target Domain Directories
  19. Port of San Diego Affected by a Ransomware Attack
  20. Phorpiex worm pivots to infect the enterprise with GandCrab ransomware
  21. Crooks turn to Delphi packers to evade malware detection
  22. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
  23. LoJax: First-ever UEFI rootkit detected in a cyberattack
  24. DanaBot trojan sets sights on Europe, new features
  25. SC Media September Product Reviews: Threat Intelligence DomainTools Iris Investigation Platform l
  26. #Malware classifcation, which encompasses both the identification and attribution of code, has the power to unlock many clues that aid
  27. New VirusTotal Enterprise Offers Private Graphs, Faster Searches
  28. Alphabet's Chronicle Releases VirusTotal Enterprise
  29. Malware steals personal information from 6.4M SheIn customers
  30. Malware hits fashion giant SHEIN; 6.42 million online shoppers affected
  31. Cybersecurity Researchers Spotted First-Ever UEFI Rootkit in the Wild
  32. Emergence of new ransomware variants feature names of popular politicians
  33. Now that Office 365 has become one of Microsoft's fastest-growing revenue streams, it has become a primary target for #ransomware.
  34. Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild
  35. Researchers find vulnerability in Apple's MDM DEP process
  36. Seven additional modules make Fancy Bear's VPNFilter malware even more versatile
  37. Cloudflare Becomes a Registrar, Sells Domains At Cost
  38. APT28 Uses LoJax, First UEFI Rootkit Seen in the Wild
  39. Alphabet's Chronicle Security Business Launches VirusTotal Enterprise
  40. VPNFilter Router Malware Adds 7 New Network Exploitation Modules
  41. Malware in the Cloud: What You Need to Know
  42. Discover how Tripwire Malware Detection... - Protects against zero-day exploits and other known threats. - Offers an enterprise view of suspicious malware objects across all monitored systems. - Protects from repeat #malware attacks. Learn more here:
  43. Malware in the Cloud: What You Need to Know

EXPLOIT

  1. Hide and seek Iot botnet updates include new Android ADB exploit
  2. Hide and seek Iot botnet updates include new Android ADB exploit
  3. VPNFilter Router Malware Adds 7 New Network Exploitation Modules
  4. Discover how Tripwire Malware Detection... - Protects against zero-day exploits and other known threats. - Offers an enterprise view of suspicious malware objects across all monitored systems. - Protects from repeat #malware attacks. Learn more here:

VULNERABILITY

  1. Local-Privilege Escalation Flaw in Linux Kernel Allows Root Access
  2. DEF CON report finds decade-old flaw in widely used ballot-counting machine
  3. Twitter fixes API bug that shared data with wrong developers
  4. How to Keep Up Security in a Bug-Infested World
  5. Twitter Bug May Have Exposed Millions of DMs
  6. Developers focus on wrong open source software vulnerabilities, research says
  7. Security Flaw Found in Apple Mobile Device Enrollment Program
  8. Cisco Releases Alerts for 14 High Severity Bugs
  9. Apple DEP vulnerability lets attackers access orgs’ resources, info
  10. Cisco unearths 13 'High Impact' IOS vulnerabilities you need to patch now
  11. How automakers are tackling connected vehicle vulnerability management
  12. Tripwire Patch Priority Index for September 2018
  13. Researchers find vulnerability in Apple's MDM DEP process
  14. GNOME 3.30.1 released: bugfixes
  15. Norwegian state discusses vulnerabilities with IT sector
  16. Mutagen Astronomy Linux Kernel vulnerability affects Red Hat, CentOS, and Debian distros
  17. KDE Plasma 5.12.7 LTS releases: fix bugs
  18. Discover how Tripwire Malware Detection... - Protects against zero-day exploits and other known threats. - Offers an enterprise view of suspicious malware objects across all monitored systems. - Protects from repeat #malware attacks. Learn more here:
  19. ex-NSA Hacker Discloses macOS Mojave 10.14 Zero-Day Vulnerability