Daily brief for 2018-10-15

ASIA

1. Did Jamal Khashoggi’s Apple Watch record his murder at Saudi consulate? Probably not
2. Octopus-infested seas of Central Asia

WORLD

3. US voter records from 19 states sold on hacking forum
4. Tens of Millions of U.S. Voter Records for Sale
5. Pentagon Defense Department travel records data breach
6. FDA Warns of Flaws in Medtronic Programmers
7. New Gallmaker APT group eschews malware in cyber espionage campaigns
8. Millions of Voter Records Found for Sale on the Dark Web
9. Pentagon Employee Data Breach, An Eye-Opener
10. Economist Nouriel Roubini: Blockchain and bitcoin are the world’s biggest scams
11. TeleBots APT Group - Links to Industroyer, NotPetya and BlackEnergy
12. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
13. Iceland hit by Biggest Cyber Attack on Record
14. Scottish Ambulance Service Exposed Employees’ Data Online
15. Pentagon Staff Hit by Major Data Breach
16. Russia-linked BlackEnergy backed new cyber attacks on Ukraine’s state bodies
17. Pentagon Data Breach Exposes up to 30,000 Travel Records
18. Un nouveau rapport montre que les attaques par ransomware ont diminué au premier semestre 2018. Les pirates se tournent vers
19. Octopus-infested seas of Central Asia
20. Iceland's largest phishing campaign imitated police
21. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
22. @ThreatFabric Gaetan van Diemen showed us the actual situation and future predictions of Mobile Banking Malware. Thx for that awesome
23. Branch.io Flaws may have affected as many as 685 million individuals
24. A Russian cyber vigilante is patching outdated MikroTik routers exposed online
25. According to #GroupIB experts, online market for counterfeit goods in Russia has reached $1,5 billion, while the number of phishing
26. Stopping Hidden Threats: How to Defend Against Fileless Attacks
27. SpankChain hacker steals the virtual currency and returns stolen ethereum

ATTACKS

28. Create an email phishing test to minimize attack vectors
29. Facebook Hack Update – 30 Million Affected; More Details Exposed; No ID Protection
30. Malware Campaign Distributes Data Stealer Trojan/RAT, Circumvents Anti-Malware
31. Up to 35 Million 2018 Voter Records For Sale on Hacking Forum
32. US voter records from 19 states sold on hacking forum
33. Tens of Millions of U.S. Voter Records for Sale
34. Pentagon Defense Department travel records data breach
35. Did Jamal Khashoggi’s Apple Watch record his murder at Saudi consulate? Probably not
36. New Gallmaker APT group eschews malware in cyber espionage campaigns
37. Microsoft Incompletely Patches JET Database Vulnerability
38. Old dog, new tricks – Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
39. Millions of Voter Records Found for Sale on the Dark Web
40. Learn how we are using #MachineLearning to detect mobile #phishing attacks with @thepacketrat and @dyngnosis: https://okt.to/W29vsS @PhishingAi @arstechnica
41. Learn how hackers launched #phishing attacks against @netflix users with expert Michael Cobb of @thehairyITdog
42. Hackers could use emoji domains to spread phishing attacks
43. Pentagon reveals cyber breach of travel records
44. Pentagon Employee Data Breach, An Eye-Opener
45. Facebook opens up about data breach details
46. Facebook data breach: Victims will not be offered free identity theft protection
47. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
48. Iceland hit by Biggest Cyber Attack on Record
49. Scottish Ambulance Service Exposed Employees’ Data Online
50. Pentagon Staff Hit by Major Data Breach
51. FitMetrix data exposed on unprotected Elasticsearch servers
52. Pentagon Data Breach Exposes up to 30,000 Travel Records
53. Iceland's largest phishing campaign imitated police
54. #Nymaim and #BankBot #Anubis PL campaign hxxp://przelewy24[.]ml/ hxxp://faktura24[.]cf/ SHA256: 4cb0b471a2132a747abf78214fbdbf0e8d7f44857996117bdbb266d42a277970 C2: bilagoong[.]tk @ThreatFabric @virqdroid @LukasStefanko
55. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
56. A Russian cyber vigilante is patching outdated MikroTik routers exposed online
57. FitMetrix Unprotected Passwordless Database Exposed Millions of User​ Data
58. Stringent password rules lower risk of personal data breaches
59. Branch.io Flaws Exposed Tinder, Shopify, Yelp Users to XSS Attacks
60. According to #GroupIB experts, online market for counterfeit goods in Russia has reached $1,5 billion, while the number of phishing
61. Google to Encrypt Android Cloud Backups With Your Lock Screen Password

THREATS

62. Small businesses repeatedly falling victim to ransomware - Kaspersky
63. 400 Percent Increase in Cryptocurrency Mining Attacks Against iOS Devices
64. Flash Updater Adds Cryptocurrency Miner
65. Ransomware hits computer networks of North Carolina water utility
66. Malware Campaign Distributes Data Stealer Trojan/RAT, Circumvents Anti-Malware
67. FDA Warns of Flaws in Medtronic Programmers
68. New Gallmaker APT group eschews malware in cyber espionage campaigns
69. Microsoft Incompletely Patches JET Database Vulnerability
70. Apple VoiceOver iOS Vulnerability Permits Hacker Access To User Photos
71. .@TenableSecurity research finds new exploits of an already patched #MikroTik router vulnerability that could enable hackers to launch remote code
72. iPhone a Growing Target of Crypto-Mining Attacks
73. Octopus Trojan exploits Telegram ban fears to snag diplomatic targets across Asia
74. Sony working on a fix for bug that's crashing PlayStation 4 consoles
75. Economist Nouriel Roubini: Blockchain and bitcoin are the world’s biggest scams
76. At the 2018 @RSAConference, researchers discussed the rise of stegware -- #malware that uses #steganography techniques to avoid detection. Learn
77. Fake Adobe update really *does* update Flash (while also installing cryptominer)
78. Apple VoiceOver iOS vulnerability permits hacker access to user photos
79. Cryptomining Malware Infects Computers via Fake Adobe Updates
80. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
81. Fake Adobe update really *does* update Flash (while also installing cryptominer)
82. Multiple Vulnerabilities Discovered in PHP Lead to Arbitrary Code Execution, DoS
83. Details of Vulnerability in Google PDFium’s JBIG2 Revealed
84. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
85. #Mobile #malware is on the rise. With mobile devices, hackers are able to access data far more sensitive than what
86. Un nouveau rapport montre que les attaques par ransomware ont diminué au premier semestre 2018. Les pirates se tournent vers
87. .@TrendMicro researchers discovered #FacexWorm, a #malware that uses a #ChromeExtension and @Facebook Messenger to spread. Learn which users are at
88. 'Flash update' scam serves up legit software, but with a side of cryptominer
89. How does the MnuBot banking Trojan use unusual C&C servers?
90. How a #cryptocurrency mining #malware infects systems
91. @ThreatFabric Gaetan van Diemen showed us the actual situation and future predictions of Mobile Banking Malware. Thx for that awesome
92. Branch.io Flaws may have affected as many as 685 million individuals
93. Godzilla Loader and the Long Tail of Malware
94. Branch.io Flaws Exposed Tinder, Shopify, Yelp Users to XSS Attacks
95. What are blockchain’s smart contracts? And how to secure them
96. Android Apps Pretend to Mine Unmineable CryptoCurrencies to Just Show Ads
97. SpankChain hacker steals the virtual currency and returns stolen ethereum
98. Sony PS4 encounters malicious code attack and receives malicious messages

CRIME

99. Online ads: a potential way in for XSS attacks
100. Facebook data breach: Victims will not be offered free identity theft protection
101. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
102. Octopus-infested seas of Central Asia
103. Iceland's largest phishing campaign imitated police
104. 'Flash update' scam serves up legit software, but with a side of cryptominer
105. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
106. A Russian cyber vigilante is patching outdated MikroTik routers exposed online
107. SpankChain hacker steals the virtual currency and returns stolen ethereum

POLITICS

108. Pentagon Defense Department travel records data breach
109. New Gallmaker APT group eschews malware in cyber espionage campaigns
110. A week in security (October 8 – 14)
111. Gallmaker - Threat Group Targeting Governments and Militaries
112. Octopus-infested seas of Central Asia
113. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
114. A Russian cyber vigilante is patching outdated MikroTik routers exposed online