Daily brief for 2018-10-09

ASIA

1. Panda Banker Trojan becomes part of Emotet threat distribution platform
2. DHS issued an alert on attacks aimed at Managed Service Providers
3. Police Warned that Phishing Text Messages are Used to Target the Bank Customers

WORLD

4. How to Evade Expensive Phishing Filters with One Simple Trick
5. Panda Banker Trojan becomes part of Emotet threat distribution platform
6. APT28 group return to covert intelligence gathering ops in Europe and South America.
7. Sony Bravia Smart TVs affected by a critical vulnerability
8. DHS issued an alert on attacks aimed at Managed Service Providers
9. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
10. Hackers breach customer rating tool used on over 7,000 websites
11. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
12. New Magecart hack detected at Shopper Approved
13. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
14. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
15. Phishing attacks use Azure Blob storage to simulate Microsoft
16. Weak IOT passwords outlawed in California
17. ​Gemalto reports 4.6 billion record breaches in the first half of 2018
18. Sunsets for Google Plus after Reports of Data Breach
19. Critical vulnerability in Sony Bravia Smart TV

ATTACKS

20. How to Evade Expensive Phishing Filters with One Simple Trick
21. URSNIF Phishing Campaign Spreads Malware by Replying to Existing E-mail Threads
22. Heathrow Fined For USB Stick Data Breach
23. Google+ Users, Upset Over Data Leak, Sue Google
24. New Cloud VPS Provider with Built-In DDoS Protection and Anti-Virus | SkySilk Cloud Services
25. Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs
26. Google+ will shut down after leaking info of 500k accounts
27. Amazon acknowledges that the company’s employees leaked user information to the seller
28. Upgrade Your Threat Intelligence Program Part 5: Take Down Fraud Campaigns & Cyber Scams
29. With a few keystrokes, Number One used the admin/admin login to siphon all the email addresses, names and titles of
30. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
31. Google: We're giving you more control over what personal data apps can use
32. As a way to inch forward in the battle of default passwords, California has passed a law that will make
33. Garmin's Navionics exposed data belonging to thousands of customers
34. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
35. Google+ shut down after bug exposed user data
36. Over 4.5 Billion Records Breached in H1 2018, Finds Report
37. Google+ Shuts Down Following Undisclosed Data Breach
38. Phishing attacks use Azure Blob storage to simulate Microsoft
39. The end of Google+: Low usage and an API bug that exposed user data
40. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy. Read the full blog here:
41. Weak IOT passwords outlawed in California
42. California’s ban on weak default passwords isn’t going to fix IoT security
43. Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake
44. Heathrow Airport fined £120,000 over USB data breach debacle
45. "Application control bypass techniques are a big thing that is happening right now - - 80% to 85% of compromises
46. New IoT botnet “hide and seek” variants target Android devices
47. For @5ean5ullivan, a security adviser at cyber firm F-Secure, a campaign’s cyber protections boil down to education — making sure
48. Google has made the decision to shut down much of its #GooglePlus social network following the disclosure of vulnerable data.
49. Hacked #Fortnite accounts and rent-a-botnet being pushed on
50. ​Gemalto reports 4.6 billion record breaches in the first half of 2018
51. Police Warned that Phishing Text Messages are Used to Target the Bank Customers
52. Hackers Targeting Instagram Accounts of Influential Profiles for Ransom in a Recent Campaign
53. one more reason to not use Facebook login everywhere, no matter how convenient it is.
54. Sunsets for Google Plus after Reports of Data Breach
55. Google Announced Google+ Shut down, Following Security Breach That Exposed 500,000 Users Accounts
56. Using web phishing, criminals have managed to steal $3.7 million (251 million rubles), which is 6% more than in the
57. Oh no, looks like we can't trust our data with Google either "Google hid major Google+ security flaw that exposed
58. Cryptojacking campaign targets add-ons for popular streaming app Kodi

THREATS

59. Cryptomining dethrones ransomware as 2018’s top threat - Webroot
60. Microsoft patches 0-day Windows flaw under attack
61. Microsoft Patches Zero-Day Under Active Attack by APT
62. VMware Workstation, Fusion, and ESXi Affected by DoS Vulnerability, No Patch Yet
63. Microsoft Patches Windows Zero-Day Exploited by 'FruityArmor' Group
64. Microsoft October 2018 Patch Tuesday fixes zero-day exploited by FruityArmor APT
65. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
66. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
67. Slideshow: Intel from Virus Bulletin 2018
68. Vulnerability in the Intel Unified Shader compiler for the Intel Graphics Accelerator
69. Git Gets Patched for Newly Found Flaw
70. Block puzzle games laced with malware | Avast
71. How does #FacexWorm #malware use @Facebook Messenger to spread? Learn more about this new malware with expert @lewisnic.
72. URSNIF Phishing Campaign Spreads Malware by Replying to Existing E-mail Threads
73. The @USAgov is rolling out #2FA authentication for officers managing .gov domains, but experts say #GoogleAuthenticator might not be the
74. Panda Banker Trojan becomes part of Emotet threat distribution platform
75. New Cloud VPS Provider with Built-In DDoS Protection and Anti-Virus | SkySilk Cloud Services
76. Microsoft October 2018 Patch Tuesday Fixes 12 Critical Vulnerabilities
77. Sony Bravia Smart TVs affected by a critical vulnerability
78. How does #MassMiner #malware infect systems across the web?
79. Hackers breach customer rating tool used on over 7,000 websites
80. The government domain registrar -- DotGov -- began rolling out two-factor #authentication for officials managing .gov domains in order to
81. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
82. Apple fixes iOS 12 passcode bypass vulnerabilities
83. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
84. Proofpoint: One month out from deadline, half of agency domains are #DMARC compliant http://ow.ly/3SRI50iYi41 via CyberScoopNews
85. Microsoft October Patch Tuesday Fixes 12 Critical Vulnerabilities
86. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
87. Sophos recently discovered a #Samsam extortion code that performs whole-company attacks through a variety of vulnerability exploits. Discover how this
88. Google+ shut down after bug exposed user data
89. Vulnerability in the Intel Unified Shader compiler for the Intel Graphics Accelerator
90. Adobe Releases Security Patch Updates for 11 Vulnerabilities
91. New Domains: A Wide-Open Playing Field for Cybercrime
92. The end of Google+: Low usage and an API bug that exposed user data
93. TOP 10 PHP Vulnerability Scanners
94. RIP Google Plus: Shutdown announced after API bug exposes 500,000 users' details
95. Active Workload Protection on Amazon EKS and AWS Fargate
96. On our new #CyberSauna podcast: Find out how F-Secure's @nxsolle and Pasi Saarinen discovered a flaw that allows attackers to get
97. Critical vulnerability in Sony Bravia Smart TV
98. Oh no, looks like we can't trust our data with Google either "Google hid major Google+ security flaw that exposed
99. #Ransomware Survival Guide: 10 things to know before, during, and after an attack:

CRIME

100. Cryptomining dethrones ransomware as 2018’s top threat - Webroot
101. How to Evade Expensive Phishing Filters with One Simple Trick
102. DHS issued an alert on attacks aimed at Managed Service Providers
103. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
104. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
105. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
106. Sophos recently discovered a #Samsam extortion code that performs whole-company attacks through a variety of vulnerability exploits. Discover how this
107. New Domains: A Wide-Open Playing Field for Cybercrime
108. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy. Read the full blog here:
109. Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake
110. Police Warned that Phishing Text Messages are Used to Target the Bank Customers

POLITICS

111. APT28 group return to covert intelligence gathering ops in Europe and South America.
112. DHS issued an alert on attacks aimed at Managed Service Providers