APT report for 2018-10-15

TRANSNATIONAL / UNKNOWN

1. New Gallmaker APT group eschews malware in cyber espionage campaigns
2. A week in security (October 8 – 14)
3. Gallmaker - Threat Group Targeting Governments and Militaries
4. Gallmaker threat group evades detection by living off the land
5. Stopping Hidden Threats: How to Defend Against Fileless Attacks

CHINA

Nil

INDIA

Nil

NORTH KOREA

6. Nintendo Switch Diablo III bundle launches November 2

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

7. TeleBots APT Group - Links to Industroyer, NotPetya and BlackEnergy
8. Russia-linked BlackEnergy backed new cyber attacks on Ukraine’s state bodies
9. Octopus-infested seas of Central Asia

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-10-15

WINDOWS

1. Flash Updater Adds Cryptocurrency Miner
2. New Gallmaker APT group eschews malware in cyber espionage campaigns
3. Fake Adobe update really *does* update Flash (while also installing cryptominer)
4. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
5. Fake Adobe update really *does* update Flash (while also installing cryptominer)
6. Octopus-infested seas of Central Asia

LINUX

Nil

UNIX

Nil

ANDROID

7. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
8. Octopus-infested seas of Central Asia
9. #Nymaim and #BankBot #Anubis PL campaign hxxp://przelewy24[.]ml/ hxxp://faktura24[.]cf/ SHA256: 4cb0b471a2132a747abf78214fbdbf0e8d7f44857996117bdbb266d42a277970 C2: bilagoong[.]tk @ThreatFabric @virqdroid @LukasStefanko
10. Android Apps Pretend to Mine Unmineable CryptoCurrencies to Just Show Ads
11. Google to Encrypt Android Cloud Backups With Your Lock Screen Password

IOS

12. 400 Percent Increase in Cryptocurrency Mining Attacks Against iOS Devices
13. Apple VoiceOver iOS Vulnerability Permits Hacker Access To User Photos
14. iPhone a Growing Target of Crypto-Mining Attacks
15. Apple VoiceOver iOS vulnerability permits hacker access to user photos
16. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise

MACOS

Nil

Threat report for 2018-10-15

DATA BREACH & DATA LOSS

1. Facebook Hack Update – 30 Million Affected; More Details Exposed; No ID Protection
2. Malware Campaign Distributes Data Stealer Trojan/RAT, Circumvents Anti-Malware
3. Up to 35 Million 2018 Voter Records For Sale on Hacking Forum
4. US voter records from 19 states sold on hacking forum
5. Tens of Millions of U.S. Voter Records for Sale
6. Pentagon Defense Department travel records data breach
7. Did Jamal Khashoggi’s Apple Watch record his murder at Saudi consulate? Probably not
8. New Gallmaker APT group eschews malware in cyber espionage campaigns
9. Microsoft Incompletely Patches JET Database Vulnerability
10. Old dog, new tricks – Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
11. Millions of Voter Records Found for Sale on the Dark Web
12. Pentagon reveals cyber breach of travel records
13. Pentagon Employee Data Breach, An Eye-Opener
14. Facebook opens up about data breach details
15. Facebook data breach: Victims will not be offered free identity theft protection
16. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
17. Iceland hit by Biggest Cyber Attack on Record
18. Scottish Ambulance Service Exposed Employees’ Data Online
19. Pentagon Staff Hit by Major Data Breach
20. FitMetrix data exposed on unprotected Elasticsearch servers
21. Pentagon Data Breach Exposes up to 30,000 Travel Records
22. Iceland's largest phishing campaign imitated police
23. #Nymaim and #BankBot #Anubis PL campaign hxxp://przelewy24[.]ml/ hxxp://faktura24[.]cf/ SHA256: 4cb0b471a2132a747abf78214fbdbf0e8d7f44857996117bdbb266d42a277970 C2: bilagoong[.]tk @ThreatFabric @virqdroid @LukasStefanko
24. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
25. A Russian cyber vigilante is patching outdated MikroTik routers exposed online
26. FitMetrix Unprotected Passwordless Database Exposed Millions of User​ Data
27. Stringent password rules lower risk of personal data breaches
28. Branch.io Flaws Exposed Tinder, Shopify, Yelp Users to XSS Attacks

DENIAL-OF-SERVICE

Nil

MALVERTISING

Nil

PHISHING

29. Create an email phishing test to minimize attack vectors
30. Learn how we are using #MachineLearning to detect mobile #phishing attacks with @thepacketrat and @dyngnosis: https://okt.to/W29vsS @PhishingAi @arstechnica
31. Learn how hackers launched #phishing attacks against @netflix users with expert Michael Cobb of @thehairyITdog
32. Hackers could use emoji domains to spread phishing attacks
33. Iceland's largest phishing campaign imitated police
34. Stringent password rules lower risk of personal data breaches
35. According to #GroupIB experts, online market for counterfeit goods in Russia has reached $1,5 billion, while the number of phishing
36. Google to Encrypt Android Cloud Backups With Your Lock Screen Password

WEB DEFACEMENT

Nil

BOTNET

Nil

RANSOMWARE

37. Small businesses repeatedly falling victim to ransomware - Kaspersky
38. Ransomware hits computer networks of North Carolina water utility
39. Un nouveau rapport montre que les attaques par ransomware ont diminué au premier semestre 2018. Les pirates se tournent vers

CRYPTOMINING & CRYPTOCURRENCIES

40. 400 Percent Increase in Cryptocurrency Mining Attacks Against iOS Devices
41. Flash Updater Adds Cryptocurrency Miner
42. iPhone a Growing Target of Crypto-Mining Attacks
43. Economist Nouriel Roubini: Blockchain and bitcoin are the world’s biggest scams
44. Fake Adobe update really *does* update Flash (while also installing cryptominer)
45. Cryptomining Malware Infects Computers via Fake Adobe Updates
46. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
47. Fake Adobe update really *does* update Flash (while also installing cryptominer)
48. 'Flash update' scam serves up legit software, but with a side of cryptominer
49. How a #cryptocurrency mining #malware infects systems
50. What are blockchain’s smart contracts? And how to secure them
51. Android Apps Pretend to Mine Unmineable CryptoCurrencies to Just Show Ads
52. SpankChain hacker steals the virtual currency and returns stolen ethereum

MALWARE

53. Malware Campaign Distributes Data Stealer Trojan/RAT, Circumvents Anti-Malware
54. New Gallmaker APT group eschews malware in cyber espionage campaigns
55. Octopus Trojan exploits Telegram ban fears to snag diplomatic targets across Asia
56. At the 2018 @RSAConference, researchers discussed the rise of stegware -- #malware that uses #steganography techniques to avoid detection. Learn
57. Cryptomining Malware Infects Computers via Fake Adobe Updates
58. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
59. #Mobile #malware is on the rise. With mobile devices, hackers are able to access data far more sensitive than what
60. .@TrendMicro researchers discovered #FacexWorm, a #malware that uses a #ChromeExtension and @Facebook Messenger to spread. Learn which users are at
61. How does the MnuBot banking Trojan use unusual C&C servers?
62. How a #cryptocurrency mining #malware infects systems
63. @ThreatFabric Gaetan van Diemen showed us the actual situation and future predictions of Mobile Banking Malware. Thx for that awesome
64. Godzilla Loader and the Long Tail of Malware
65. Sony PS4 encounters malicious code attack and receives malicious messages

EXPLOIT

66. New Technique Recycles Exploit Chain to Keep Antivirus Silent

VULNERABILITY

67. FDA Warns of Flaws in Medtronic Programmers
68. Microsoft Incompletely Patches JET Database Vulnerability
69. Apple VoiceOver iOS Vulnerability Permits Hacker Access To User Photos
70. .@TenableSecurity research finds new exploits of an already patched #MikroTik router vulnerability that could enable hackers to launch remote code
71. Sony working on a fix for bug that's crashing PlayStation 4 consoles
72. Apple VoiceOver iOS vulnerability permits hacker access to user photos
73. Multiple Vulnerabilities Discovered in PHP Lead to Arbitrary Code Execution, DoS
74. Details of Vulnerability in Google PDFium’s JBIG2 Revealed
75. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
76. Branch.io Flaws may have affected as many as 685 million individuals
77. Branch.io Flaws Exposed Tinder, Shopify, Yelp Users to XSS Attacks

Region brief for 2018-10-15

ASIA

1. Did Jamal Khashoggi’s Apple Watch record his murder at Saudi consulate? Probably not
2. Octopus-infested seas of Central Asia

OCEANIA

Nil

NORTH AMERICA

3. US voter records from 19 states sold on hacking forum
4. Tens of Millions of U.S. Voter Records for Sale
5. Pentagon Defense Department travel records data breach
6. FDA Warns of Flaws in Medtronic Programmers
7. Millions of Voter Records Found for Sale on the Dark Web
8. Pentagon Employee Data Breach, An Eye-Opener
9. Economist Nouriel Roubini: Blockchain and bitcoin are the world’s biggest scams
10. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
11. Pentagon Staff Hit by Major Data Breach
12. Pentagon Data Breach Exposes up to 30,000 Travel Records
13. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
14. @ThreatFabric Gaetan van Diemen showed us the actual situation and future predictions of Mobile Banking Malware. Thx for that awesome
15. Branch.io Flaws may have affected as many as 685 million individuals
16. Stopping Hidden Threats: How to Defend Against Fileless Attacks
17. SpankChain hacker steals the virtual currency and returns stolen ethereum

SOUTH AMERICA

18. A Russian cyber vigilante is patching outdated MikroTik routers exposed online

EUROPE

19. New Gallmaker APT group eschews malware in cyber espionage campaigns
20. TeleBots APT Group - Links to Industroyer, NotPetya and BlackEnergy
21. Iceland hit by Biggest Cyber Attack on Record
22. Scottish Ambulance Service Exposed Employees’ Data Online
23. Russia-linked BlackEnergy backed new cyber attacks on Ukraine’s state bodies
24. Un nouveau rapport montre que les attaques par ransomware ont diminué au premier semestre 2018. Les pirates se tournent vers
25. Octopus-infested seas of Central Asia
26. Iceland's largest phishing campaign imitated police
27. A Russian cyber vigilante is patching outdated MikroTik routers exposed online
28. According to #GroupIB experts, online market for counterfeit goods in Russia has reached $1,5 billion, while the number of phishing

AFRICA

Nil

Sector brief for 2018-10-15

HEALTHCARE

1. A week in security (October 8 – 14)

TRANSPORT

Nil

BANKING & FINANCE

2. Pentagon Defense Department travel records data breach
3. A week in security (October 8 – 14)
4. Pentagon Employee Data Breach, An Eye-Opener
5. Economist Nouriel Roubini: Blockchain and bitcoin are the world’s biggest scams
6. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
7. Pentagon Staff Hit by Major Data Breach
8. FitMetrix data exposed on unprotected Elasticsearch servers
9. How does the MnuBot banking Trojan use unusual C&C servers?
10. @ThreatFabric Gaetan van Diemen showed us the actual situation and future predictions of Mobile Banking Malware. Thx for that awesome
11. Stopping Hidden Threats: How to Defend Against Fileless Attacks
12. SpankChain hacker steals the virtual currency and returns stolen ethereum

INFORMATION & TELECOMMUNICATION

13. Ransomware hits computer networks of North Carolina water utility
14. Facebook Hack Update – 30 Million Affected; More Details Exposed; No ID Protection
15. A week in security (October 8 – 14)
16. Learn how we are using #MachineLearning to detect mobile #phishing attacks with @thepacketrat and @dyngnosis: https://okt.to/W29vsS @PhishingAi @arstechnica
17. Facebook opens up about data breach details
18. Facebook data breach: Victims will not be offered free identity theft protection
19. #Mobile #malware is on the rise. With mobile devices, hackers are able to access data far more sensitive than what
20. Un nouveau rapport montre que les attaques par ransomware ont diminué au premier semestre 2018. Les pirates se tournent vers
21. .@TrendMicro researchers discovered #FacexWorm, a #malware that uses a #ChromeExtension and @Facebook Messenger to spread. Learn which users are at
22. @ThreatFabric Gaetan van Diemen showed us the actual situation and future predictions of Mobile Banking Malware. Thx for that awesome
23. Stringent password rules lower risk of personal data breaches
24. According to #GroupIB experts, online market for counterfeit goods in Russia has reached $1,5 billion, while the number of phishing

FOOD

Nil

WATER

25. Ransomware hits computer networks of North Carolina water utility

ENERGY

26. TeleBots APT Group - Links to Industroyer, NotPetya and BlackEnergy

GOVERNMENT & PUBLIC SERVICE

27. Tens of Millions of U.S. Voter Records for Sale
28. A week in security (October 8 – 14)

Daily brief for 2018-10-15

ASIA

1. Did Jamal Khashoggi’s Apple Watch record his murder at Saudi consulate? Probably not
2. Octopus-infested seas of Central Asia

WORLD

3. US voter records from 19 states sold on hacking forum
4. Tens of Millions of U.S. Voter Records for Sale
5. Pentagon Defense Department travel records data breach
6. FDA Warns of Flaws in Medtronic Programmers
7. New Gallmaker APT group eschews malware in cyber espionage campaigns
8. Millions of Voter Records Found for Sale on the Dark Web
9. Pentagon Employee Data Breach, An Eye-Opener
10. Economist Nouriel Roubini: Blockchain and bitcoin are the world’s biggest scams
11. TeleBots APT Group - Links to Industroyer, NotPetya and BlackEnergy
12. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
13. Iceland hit by Biggest Cyber Attack on Record
14. Scottish Ambulance Service Exposed Employees’ Data Online
15. Pentagon Staff Hit by Major Data Breach
16. Russia-linked BlackEnergy backed new cyber attacks on Ukraine’s state bodies
17. Pentagon Data Breach Exposes up to 30,000 Travel Records
18. Un nouveau rapport montre que les attaques par ransomware ont diminué au premier semestre 2018. Les pirates se tournent vers
19. Octopus-infested seas of Central Asia
20. Iceland's largest phishing campaign imitated police
21. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
22. @ThreatFabric Gaetan van Diemen showed us the actual situation and future predictions of Mobile Banking Malware. Thx for that awesome
23. Branch.io Flaws may have affected as many as 685 million individuals
24. A Russian cyber vigilante is patching outdated MikroTik routers exposed online
25. According to #GroupIB experts, online market for counterfeit goods in Russia has reached $1,5 billion, while the number of phishing
26. Stopping Hidden Threats: How to Defend Against Fileless Attacks
27. SpankChain hacker steals the virtual currency and returns stolen ethereum

ATTACKS

28. Create an email phishing test to minimize attack vectors
29. Facebook Hack Update – 30 Million Affected; More Details Exposed; No ID Protection
30. Malware Campaign Distributes Data Stealer Trojan/RAT, Circumvents Anti-Malware
31. Up to 35 Million 2018 Voter Records For Sale on Hacking Forum
32. US voter records from 19 states sold on hacking forum
33. Tens of Millions of U.S. Voter Records for Sale
34. Pentagon Defense Department travel records data breach
35. Did Jamal Khashoggi’s Apple Watch record his murder at Saudi consulate? Probably not
36. New Gallmaker APT group eschews malware in cyber espionage campaigns
37. Microsoft Incompletely Patches JET Database Vulnerability
38. Old dog, new tricks – Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
39. Millions of Voter Records Found for Sale on the Dark Web
40. Learn how we are using #MachineLearning to detect mobile #phishing attacks with @thepacketrat and @dyngnosis: https://okt.to/W29vsS @PhishingAi @arstechnica
41. Learn how hackers launched #phishing attacks against @netflix users with expert Michael Cobb of @thehairyITdog
42. Hackers could use emoji domains to spread phishing attacks
43. Pentagon reveals cyber breach of travel records
44. Pentagon Employee Data Breach, An Eye-Opener
45. Facebook opens up about data breach details
46. Facebook data breach: Victims will not be offered free identity theft protection
47. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
48. Iceland hit by Biggest Cyber Attack on Record
49. Scottish Ambulance Service Exposed Employees’ Data Online
50. Pentagon Staff Hit by Major Data Breach
51. FitMetrix data exposed on unprotected Elasticsearch servers
52. Pentagon Data Breach Exposes up to 30,000 Travel Records
53. Iceland's largest phishing campaign imitated police
54. #Nymaim and #BankBot #Anubis PL campaign hxxp://przelewy24[.]ml/ hxxp://faktura24[.]cf/ SHA256: 4cb0b471a2132a747abf78214fbdbf0e8d7f44857996117bdbb266d42a277970 C2: bilagoong[.]tk @ThreatFabric @virqdroid @LukasStefanko
55. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
56. A Russian cyber vigilante is patching outdated MikroTik routers exposed online
57. FitMetrix Unprotected Passwordless Database Exposed Millions of User​ Data
58. Stringent password rules lower risk of personal data breaches
59. Branch.io Flaws Exposed Tinder, Shopify, Yelp Users to XSS Attacks
60. According to #GroupIB experts, online market for counterfeit goods in Russia has reached $1,5 billion, while the number of phishing
61. Google to Encrypt Android Cloud Backups With Your Lock Screen Password

THREATS

62. Small businesses repeatedly falling victim to ransomware - Kaspersky
63. 400 Percent Increase in Cryptocurrency Mining Attacks Against iOS Devices
64. Flash Updater Adds Cryptocurrency Miner
65. Ransomware hits computer networks of North Carolina water utility
66. Malware Campaign Distributes Data Stealer Trojan/RAT, Circumvents Anti-Malware
67. FDA Warns of Flaws in Medtronic Programmers
68. New Gallmaker APT group eschews malware in cyber espionage campaigns
69. Microsoft Incompletely Patches JET Database Vulnerability
70. Apple VoiceOver iOS Vulnerability Permits Hacker Access To User Photos
71. .@TenableSecurity research finds new exploits of an already patched #MikroTik router vulnerability that could enable hackers to launch remote code
72. iPhone a Growing Target of Crypto-Mining Attacks
73. Octopus Trojan exploits Telegram ban fears to snag diplomatic targets across Asia
74. Sony working on a fix for bug that's crashing PlayStation 4 consoles
75. Economist Nouriel Roubini: Blockchain and bitcoin are the world’s biggest scams
76. At the 2018 @RSAConference, researchers discussed the rise of stegware -- #malware that uses #steganography techniques to avoid detection. Learn
77. Fake Adobe update really *does* update Flash (while also installing cryptominer)
78. Apple VoiceOver iOS vulnerability permits hacker access to user photos
79. Cryptomining Malware Infects Computers via Fake Adobe Updates
80. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
81. Fake Adobe update really *does* update Flash (while also installing cryptominer)
82. Multiple Vulnerabilities Discovered in PHP Lead to Arbitrary Code Execution, DoS
83. Details of Vulnerability in Google PDFium’s JBIG2 Revealed
84. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
85. #Mobile #malware is on the rise. With mobile devices, hackers are able to access data far more sensitive than what
86. Un nouveau rapport montre que les attaques par ransomware ont diminué au premier semestre 2018. Les pirates se tournent vers
87. .@TrendMicro researchers discovered #FacexWorm, a #malware that uses a #ChromeExtension and @Facebook Messenger to spread. Learn which users are at
88. 'Flash update' scam serves up legit software, but with a side of cryptominer
89. How does the MnuBot banking Trojan use unusual C&C servers?
90. How a #cryptocurrency mining #malware infects systems
91. @ThreatFabric Gaetan van Diemen showed us the actual situation and future predictions of Mobile Banking Malware. Thx for that awesome
92. Branch.io Flaws may have affected as many as 685 million individuals
93. Godzilla Loader and the Long Tail of Malware
94. Branch.io Flaws Exposed Tinder, Shopify, Yelp Users to XSS Attacks
95. What are blockchain’s smart contracts? And how to secure them
96. Android Apps Pretend to Mine Unmineable CryptoCurrencies to Just Show Ads
97. SpankChain hacker steals the virtual currency and returns stolen ethereum
98. Sony PS4 encounters malicious code attack and receives malicious messages

CRIME

99. Online ads: a potential way in for XSS attacks
100. Facebook data breach: Victims will not be offered free identity theft protection
101. September 2018’s Most Wanted Malware: Cryptomining Attacks Against Apple Devices On The Rise
102. Octopus-infested seas of Central Asia
103. Iceland's largest phishing campaign imitated police
104. 'Flash update' scam serves up legit software, but with a side of cryptominer
105. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
106. A Russian cyber vigilante is patching outdated MikroTik routers exposed online
107. SpankChain hacker steals the virtual currency and returns stolen ethereum

POLITICS

108. Pentagon Defense Department travel records data breach
109. New Gallmaker APT group eschews malware in cyber espionage campaigns
110. A week in security (October 8 – 14)
111. Gallmaker - Threat Group Targeting Governments and Militaries
112. Octopus-infested seas of Central Asia
113. Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox
114. A Russian cyber vigilante is patching outdated MikroTik routers exposed online