Daily brief for 2018-10-03

ASIA

1. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
2. FakeSpy Is Back as Part of New SmiShing Campaign, Adds New Features
3. DHS aware of ongoing APT attacks on cloud service providers
4. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
5. FireEye unmasks a new North Korean threat group
6. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
7. APT38: Details on New North Korean Regime-Backed Threat Group
8. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
9. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
10. Zoho domains central to keylogger, data theft campaigns worldwide
11. GhostDNS hijacked 100,000 router traffic directed to phishing sites
12. Researchers associated the recently discovered NOKKI Malware to North Korean APT
13. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
14. North Korean HIDDEN COBRA Hackers Using New Attack Called “FASTCash” to Cash-out From ATM Machine
15. Enormous botnet used to hijack traffic destined for Brazilian banks

WORLD

16. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
17. Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain
18. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
19. FireEye unmasks a new North Korean threat group
20. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
21. APT38: Details on New North Korean Regime-Backed Threat Group
22. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
23. #DanaBot Observed in Large Campaign Targeting U.S. Organizations
24. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
25. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
26. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
27. New Danabot Banking Malware campaign now targets banks in the U.S.
28. Hacker faces jail time after defacing US military academy, NYC sites
29. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
30. GhostDNS hijacked 100,000 router traffic directed to phishing sites
31. The Intel Management Engine exposes a new vulnerability
32. See clearly, decide wisely with visibility and management
33. Researchers associated the recently discovered NOKKI Malware to North Korean APT
34. Ransomware Hits Port of San Diego
35. Z-LAB Report – Analyzing the GandCrab v5 ransomware
36. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
37. Vulnerabilities expose Iomega and LenovoEMC NAS devices to attacks
38. Facebook faces legal actions after data breach
39. Estonia sues Gemalto for €152M for the flaws in the identification cards issued by the company
40. Enormous botnet used to hijack traffic destined for Brazilian banks
41. 100,000 routers hijacked by GhostDNS, traffic directed to phishing sites
42. DanaBot Observed in Large Campaign Targeting U.S. Organizations

ATTACKS

43. Phishing 101: Protection for Everyone
44. FakeSpy Is Back as Part of New SmiShing Campaign, Adds New Features
45. How to use the Firefox Master Password
46. The ultimate fallout from the Facebook data breach could be massive
47. Phishing gets more complex as decoy PDF pops up with Microsoft-issued SSL certificate
48. LastPass study shines new light on global password security practices
49. Do you know the top myths and facts of #mobile #phishing? If not, don't worry, we've compiled a list of
50. Hacker Faces Jail Time After Defacing West Point, NYC Sites
51. Gwinnett Medical Center Investigates Possible Data Breach
52. Torii Botnet - Definitely Not a Mirai Wannabe
53. Instagram Used as Marketplace to Sell Stolen Fortnite Accounts and Botnets
54. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
55. Phishing Attack Impersonates Law Firm
56. Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft
57. Hacked Fortnite accounts and rent-a-botnet being pushed on Instagram
58. Gwinnett Medical Center investigates possible data breach
59. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
60. GhostDNS hijacking campaign steps up attacks on Brazilians; 100K+ devices compromised
61. Phishing Attack Impersonates Law Firm
62. #DanaBot Observed in Large Campaign Targeting U.S. Organizations
63. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
64. Facebook Reveals That Trio of Bugs Led to Data Breach
65. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
66. New Danabot Banking Malware campaign now targets banks in the U.S.
67. Hacker faces jail time after defacing US military academy, NYC sites
68. Zoho domains central to keylogger, data theft campaigns worldwide
69. Password-sharing is still prevalent in the workplace – although 45 percent of businesses do now use multifactor authentication:
70. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
71. GhostDNS hijacked 100,000 router traffic directed to phishing sites
72. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
73. .@Lookout’s @VijayaKaza is at @FedNewsRadio’s studio recording with @gschumm!
74. How Ashley Madison Recovered From Its Massive Data Breach
75. Hackers Use Instagram For Selling Stolen ‘Fortnite’ Accounts And Botnets
76. An extremely high number of keylogger #phishing campaigns have been seen tied to the Zoho online office suite software:
77. New Betabot campaign under the microscope
78. CyberSecurity Asean security alert on A Vulnerability in Microsoft Windows JET Database Engine Could Allow for Remote Code Execution
79. Facebook faces legal actions after data breach
80. Enormous botnet used to hijack traffic destined for Brazilian banks
81. BYOB – Build Your Own Botnet
82. The @activereach guide to #DDoS, is aimed at technically aware business people who do not necessarily have a background in
83. What is the future of authentication? Hint: It’s not passwords, passphrases or MFA
84. Norton by Symantec Urges Consumers to Help Protect Their Personal Data
85. 100,000 routers hijacked by GhostDNS, traffic directed to phishing sites
86. DanaBot Observed in Large Campaign Targeting U.S. Organizations

THREATS

87. Windows 10 October 2018 Update refines ransomware protection
88. Virus Bulletin 2018: macOS Flaw Allows Attackers to Hijack Installed Apps
89. Virus Bulletin 2018: Microsoft’s Lambert on How Cloud is Changing Security
90. [SingCERT] Alert on 47 Critical Vulnerabilities in Adobe Acrobat and Adobe Reader
91. Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain
92. Mozilla Firefox Releases 62.0.3 & Security Updates for 2 High Critical Vulnerabilities
93. Betabot - An Example of Cheap Modern Malware Sophistication
94. Instagram accounts frozen with ransomware | Avast
95. Instagram accounts frozen with ransomware | Avast
96. Did you know that 1 in 131 emails contains malware? In honor of #NCSAM, secure your spot for #RiskSec, expand
97. Women in Information Security: Pam Armstrong
98. Vulnerability Spotlight: Google PDFium JBIG2 Image ComposeToOpt2WithRect Information Disclosure Vulnerability
99. New KONNI Malware Attacking Eurasia and Southeast Asia
100. Google Taking New Steps To Prevent Malicious Chrome Extensions
101. Foxit patches 118 vulnerabilities in popular PDF reader
102. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
103. Experts found 9 NAS flaws that expose LenovoEMC, Iomega Devices to hack
104. Network Outage at Some Recipe Unlimited Locations Caused by Malware
105. The one serious MacBook Pro security flaw that nobody is talking about
106. Update now: Adobe fixes 85 serious flaws in Acrobat and Reader
107. Labeless Part 6: How to Resolve Obfuscated API Calls in the Ngioweb Proxy Malware
108. 18 Vulnerabilities Found in Foxit PDF Reader
109. Banking trojans, not #ransomware, are the biggest threat to the enterprise now.
110. Labeless Part 5: How to Decrypt Strings in Boleto Banking Malware Without Reconstructing Decryption Algorithm.
111. 18 Vulnerabilities Found in Foxit PDF Reader
112. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
113. Marine Corps bug bounty program finds 150 vulnerabilities
114. TP-Link router vulnerable to remote takeover flaw
115. Cisco Talos spotted 18 vulnerabilities in Foxit PDF Reader, 8 in Atlantis World Processor
116. Adobe update cleans up 86 bugs in Acrobat and Reader, many critical
117. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
118. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
119. Facebook Reveals That Trio of Bugs Led to Data Breach
120. TP-Link router vulnerable to remote takeover flaw
121. Adobe update cleans up 86 bugs in Acrobat and Reader, many critical
122. New Danabot Banking Malware campaign now targets banks in the U.S.
123. Zoho domains central to keylogger, data theft campaigns worldwide
124. Recipe Unlimited denies ransomware attack, despite alleged ransom note
125. The Intel Management Engine exposes a new vulnerability
126. How an improper #authentication flaw affects
127. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
128. IDG Contributor Network: Will your company be valued by its price-to-data ratio?
129. Researchers from @alienvault found a new #cryptocurrency mining malware -- dubbed #MassMiner -- that infects systems across the web. Learn
130. Introducing... THE HUNT: A Cyber Attack in the Process Industry
131. Vulnerability Spotlight: Google PDFium JBIG2 Image ComposeToOpt2WithRect Information Disclosure Vulnerability
132. Researchers associated the recently discovered NOKKI Malware to North Korean APT
133. Changes to #Sanny #malware delivery method attacks were recently discovered by @FireEye researches. Learn who is at risk and how
134. Ransomware Hits Port of San Diego
135. An extremely high number of keylogger #phishing campaigns have been seen tied to the Zoho online office suite software:
136. Z-LAB Report – Analyzing the GandCrab v5 ransomware
137. CyberSecurity Asean security alert on A Vulnerability in Microsoft Windows JET Database Engine Could Allow for Remote Code Execution
138. Preventing and Detecting Malicious Insiders
139. Vulnerabilities expose Iomega and LenovoEMC NAS devices to attacks
140. Estonia sues Gemalto for €152M for the flaws in the identification cards issued by the company
141. Scanning for OWASP Top 10 Vulnerabilities with Metasploit for the Web(w3af)
142. Mozilla Firefox 62.0.3 releases: Fixed hangs on macOS Mojave & security bugs
143. In 1999, AV-TEST reported that there were 98,428 total unique malware samples. Today, AV-TEST registers over 350,000 new pieces of
144. Apple iOS 12 Texting Bug Sends Messages To Wrong Contacts
145. Heipparallaa! Uudessa jaksossamme sivuutamme ajankohtaiset aiheet ja keskitymme puhumaan @japi999 ja @ekoivune kanssa tietoturva-asiantuntijuudesta. Bonusvieraana tällä kertaa OpSecin sijaan @Larppa1337!
146. Cheap Android Phones and Poor Quality Control Leads to Malware Surprise
147. DanaBot Observed in Large Campaign Targeting U.S. Organizations

CRIME

148. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
149. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
150. FireEye unmasks a new North Korean threat group
151. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
152. APT38: Details on New North Korean Regime-Backed Threat Group
153. Banking trojans, not #ransomware, are the biggest threat to the enterprise now.
154. Labeless Part 5: How to Decrypt Strings in Boleto Banking Malware Without Reconstructing Decryption Algorithm.
155. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
156. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
157. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
158. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
159. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
160. New Danabot Banking Malware campaign now targets banks in the U.S.
161. Zoho domains central to keylogger, data theft campaigns worldwide
162. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
163. GhostDNS hijacked 100,000 router traffic directed to phishing sites
164. Recipe Unlimited denies ransomware attack, despite alleged ransom note
165. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
166. Ransomware Hits Port of San Diego
167. Z-LAB Report – Analyzing the GandCrab v5 ransomware
168. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
169. North Korean HIDDEN COBRA Hackers Using New Attack Called “FASTCash” to Cash-out From ATM Machine
170. New Betabot campaign under the microscope
171. Facebook faces legal actions after data breach
172. Estonia sues Gemalto for €152M for the flaws in the identification cards issued by the company
173. Enormous botnet used to hijack traffic destined for Brazilian banks
174. BYOB – Build Your Own Botnet
175. What is the future of authentication? Hint: It’s not passwords, passphrases or MFA
176. DanaBot Observed in Large Campaign Targeting U.S. Organizations

POLITICS

177. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
178. DHS aware of ongoing APT attacks on cloud service providers
179. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
180. FireEye unmasks a new North Korean threat group
181. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
182. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
183. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
184. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
185. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks