Threat report for 2018-11-16

DATA BREACH & DATA LOSS

1. Russian APT comes back to life with new US spear-phishing campaign
2. EgressBuster – Compromise Victim via Command & Control using Firewall
3. Voxox Database Containing Around 26 Million SMS Entries Exposed 2FA, Reset Codes
4. China's Hack Attacks: An Economic Espionage Campaign
5. New HealthEquity Data Breach Exposes PII/PHI of Almost 21,000 Customers
6. AWS Adds New Feature for Preventing Data Leaks
7. Details of 170,000 Pakistani debit cards leaked on dark web
8. AWS rolls out new security feature to prevent accidental S3 data leaks
9. Google BGP route leak was accidental, not hijacking
10. After early speculation of #malicious intent, experts said an accidental misconfiguration caused the BGP route leak that sent traffic destined
11. After 2015 OPM data breach, agency failed to update security
12. 26M Texts Exposed in Poorly Secured Vovox Database
13. Data Breaches on the Rise in Financial Services
14. SUNY Upstate Hospital announced a former employee inappropriately accessed more than 1,200 patient records.
15. 2FA codes are great for security, except when 26M of them are leaked
16. Business email compromise attacks cost over $676 million in 2017, according to the @FBI's Internet #CrimeReport. Learn how to recognize
17. #GroupIB #ThreatIntelligence detected large set of compromised payment cards details that was put on sale on underground card shop on
18. French Company Data Breach Causes Sensitive Information Stolen to the Hackers
19. Text message database reportedly leaked password resets
20. New variants of Meltdown and Spectre cause information leaks

DENIAL-OF-SERVICE

Nil

MALVERTISING

Nil

PHISHING

21. Russian APT comes back to life with new US spear-phishing campaign
22. Gmail Glitch Offers Stealthy Trick for Phishing Attacks
23. Russian Banks Hit By Major Phishing Attacks
24. How to Stay One Step Ahead of Phishing Websites — Literally
25. Emotet has some customized phish for you
26. Russian banks hit by major phishing attacks from two hacker groups
27. Word of the Day: social engineering
28. Create and enforce a password policy across the enterprise
30. Massive Rise is Seen in Phishing Attacks
31. Warning Issued by Emirates NBD over VAT Phishing Email Targeting its Customers
32. Text message database reportedly leaked password resets
33. Consider a reputable password manager to store your information, and don’t forget to use a strong password to secure the

WEB DEFACEMENT

Nil

BOTNET

34. phpMyAdmin Servers Targeted By New Variant of Muhstik Botnet
35. NTT Security Adds Botnet Infrastructure Detection to Managed Security Services
36. Mylobot Botnet Now Exfiltrates Data Using Second Stage Khalesi Trojan

RANSOMWARE

37. Stealthy DarkGate Cryptocurrency Mining and Ransomware Evades AV Detection
38. SamSam and GandCrab Illustrate Evolution of Ransomware
39. Hacking group returns, switches attacks from ransomware to trojan malware
40. .@TalosSecurity recently created a #decryptor that helps files affected by the #ransomware #Thanatos -- typically known to not decrypt files
41. Malaysia’s Largest Media Company Allegedly Suffers Ransomware Attack
42. Hacking group returns, switches attacks from ransomware to trojan malware
43. Hackers infect Malaysia’s largest media company with ransomware, then demand $6.45 million
44. How does Thanatos ransomware decryptor tool restore data?
45. SentinelOne Detects KeyPass Ransomware! KeyPass is a new ransomware threat that has hit at least 20 countries and appears to be

CRYPTOMINING & CRYPTOCURRENCIES

46. Cryptocurrency Trader Gets 15 Months of Jail for Stealing Bitcoin, Litecoin
47. Stealthy DarkGate Cryptocurrency Mining and Ransomware Evades AV Detection
48. This Week in Security News: Holiday Cybercriminals & Cryptomining Malware
49. Most antivirus programs fail to detect this cryptocurrency-stealing malware
50. Hackers stole millions from ATMs across the world. @verge shares details here.
51. Four More Malicious Cryptocurrency Apps on Google Play
52. Google, US and Israeli politician Twitter accounts hijacked to promote 'Elon Musk' Bitcoin scam
53. 5 Top Techniques for Testing Blockchain Apps
54. Digital identity, the blockchain and the GDPR: A round peg in a square hole?
55. New WebCobra Cryptojacking Malware Uses Platform Specific Miners

MALWARE

56. EgressBuster – Compromise Victim via Command & Control using Firewall
57. Reappearance of Magecart Malware to Infect Virtual Stores
58. Using Microsoft Powerpoint as Malware Dropper
59. Hacking group returns, switches attacks from ransomware to trojan malware
60. This Week in Security News: Holiday Cybercriminals & Cryptomining Malware
61. Simple Call Recorder Android Malware
62. After early speculation of #malicious intent, experts said an accidental misconfiguration caused the BGP route leak that sent traffic destined
63. Cybaze ZLab- Yoroi team spotted a new variant of the APT28 Lojax rootkit
64. Researchers at @okta found a bypass that allows #ThreatActors to pose files as legitimate @Apple files despite being #malware and
65. Most antivirus programs fail to detect this cryptocurrency-stealing malware
66. APT group TA505 testing out new modular RAT
67. tRat is a new modular RAT used by the threat actor TA505
68. Hacking group returns, switches attacks from ransomware to trojan malware
69. Malicious code hidden in advert images cost ad networks $1.13bn this year
70. Four More Malicious Cryptocurrency Apps on Google Play
71. Vaporworms: New breed of self-propagating fileless malware to emerge in 2019
72. Dridex/Locky Operators Unleash New Malware in Recent Attack
73. New WebCobra Cryptojacking Malware Uses Platform Specific Miners
74. AMD launches new mid-range graphics card RX 590 based on 12nm process
75. Mylobot Botnet Now Exfiltrates Data Using Second Stage Khalesi Trojan

EXPLOIT

Nil

VULNERABILITY

76. Up to three million kids' GPS watches can be tracked by parents... and any miscreant: Flaws spill pick-and-choose catalog for perverts
77. Critical WordPress Flaw Grants Admin Access to Any Registered Site User
78. Adobe Patch Tuesday November Fixed Multiple Information Disclosure Vulnerabilities
79. Lock-Screen Bypass Bug Quietly Patched in Handsets
80. Scanning Akamai's Edge Servers for Vulnerabilities, Correctly
81. ATM Tests Reveal Surprising Security Flaws
82. SUNY Upstate Hospital announced a former employee inappropriately accessed more than 1,200 patient records.
83. D-Link router vulnerability detailed
84. Apache Struts2 Commons FileUpload Deserialization Remote Code Execution Vulnerability (CVE-2016-100031)Threat Alert
85. Amid calls for a Windows bug status dashboard, Microsoft belatedly agrees to build one
86. Kaspersky Announces the Details of Windows 7 Zero-Day Vulnerability