APT report for 2018-11-02

TRANSNATIONAL / UNKNOWN

1. Magecart cybergang targeting e-commerce credit card data
2. Magecart claims fresh victim in electronics kit seller Kitronik

CHINA

3. Beware this malware: it can even survive operating systems being reinstalled

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

4. New Data Affirms Cyber Threat for Industrial Control Systems
5. Beware this malware: it can even survive operating systems being reinstalled

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-11-02

WINDOWS

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Spam campaign targets Exodus Mac Users
3. New Data Affirms Cyber Threat for Industrial Control Systems
4. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
5. How to password protect a folder or file in Windows | Avast
6. Beware this malware: it can even survive operating systems being reinstalled
7. Search for “Installing Chrome” on Bing can lead to malicious content

LINUX

8. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
9. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
10. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes

UNIX

Nil

ANDROID

11. Two botnets are fighting over control of thousands of unsecured Android devices
12. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities

IOS

Nil

MACOS

13. Spam campaign targets Exodus Mac Users
14. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures

Threat report for 2018-11-02

DATA BREACH & DATA LOSS

1. Two botnets are fighting over control of thousands of unsecured Android devices
2. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
3. Spam campaign targets Exodus Mac Users
4. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
5. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
6. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
7. ePHI of 8,000 Patients Exposed in Health Plan Breach
8. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
9. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
10. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
11. SamSam ransomware campaigns continue to target U.S. in 2018
12. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
13. Radisson Hotel Group Hit by Data Breach
14. Spam campaign targets Exodus Mac Users
15. Shipbuilder, defense contractor Austal reveals data breach
16. Data theft at Radisson Hotel Group
17. 85 million voter records on sale
18. Iran has become victim of a cyberattack campaign
19. Apache HBase 2.1.1 release, distributed database
20. FIFA admits hack and braces for new leaks

DENIAL-OF-SERVICE

21. ThreatList: Fewer Big DDoS Attacks in Q3, Overall Rate Holds Steady
22. Bushido Botnet and DDoS-for-Hire

MALVERTISING

Nil

PHISHING

23. SMS Phishing + Cardless ATM = Profit
24. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
25. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
26. How to password protect a folder or file in Windows | Avast
27. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
28. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
29. YAPBS – Yet Another Password Breach Scam

WEB DEFACEMENT

Nil

BOTNET

30. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
31. Bushido Botnet and DDoS-for-Hire
32. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
33. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
34. 'Outlaw' threat actor uses Shellbot variant to form new botnet

RANSOMWARE

35. New Ransomware using DiskCryptor With Custom Ransom Message
36. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
37. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
38. SamSam ransomware campaigns continue to target U.S. in 2018
39. Kraken ransomware gets packaged into Fallout EK
40. Giant ransomware bundle threatens to make malware attacks easier for crooks

CRYPTOMINING & CRYPTOCURRENCIES

41. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
42. Kraken ransomware gets packaged into Fallout EK
43. Blockwatch: The aeternity Blockchain
44. Trading with cryptocurrencies without losing self control
45. EY launches the world's first secure private transactions over the Ethereum public blockchain
46. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

MALWARE

47. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
48. ​The day computer security turned real: The Morris Worm turns 30
49. Worst Malware and Threat Actors of 2018
50. Adversaries Distribute Malware Via Rarely Used Extensions
51. Can you spot a malicious email? Take the quiz at
52. Antimalware Day: The evolution of malicious code
53. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
54. Beware this malware: it can even survive operating systems being reinstalled
55. Emotet Trojan Changes Tactics…Again
56. Giant ransomware bundle threatens to make malware attacks easier for crooks
57. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
58. U.S. Geological Survey Network got Infected with Malware
59. Search for “Installing Chrome” on Bing can lead to malicious content
60. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers

EXPLOIT

61. Kraken ransomware gets packaged into Fallout EK
62. How to Perform Manual SQL Injection With Double quotes Error Based String Method
63. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these

VULNERABILITY

64. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
65. Cisco Security Appliance Zero-Day Found Actively Exploited in the Wild
66. BLEEDINGBIT – Two Zero Day Vulnerabilities Affecting Wireless Access Point Bluetooth Chips
67. Hackers actively exploiting vulnerabilities in Cisco security appliances
68. Cisco fixed the high-risk security vulnerabilities in variant products
69. Bluetooth Bugs Speak to Lack of Security in DevOps
70. Sauter Quickly Patches Flaw in Building Automation Software
71. Bleedingbit vulnerabilities put Wi-Fi access points at risk
72. Test IO introduces Bug Fix Confirmation, leveraging network of software testers to verify bug fixes
73. Flaw in Sophos HitmanPro.Alert could enable hackers to gain privileges over systems
74. Intel CPUs impacted by new PortSmash side-channel vulnerability
75. CISCO warn of a zero-day DoS flaw that is being actively exploited in attacks
76. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes
77. .@ArmisSecurity researchers discovered two chip-level #Bluetooth vulnerabilities -- dubbed #Bleedingbit -- that could allow pseudo #RemoteCodeExecution on wireless access points.
78. Cisco Reports SIP Inspection Vulnerability
79. Mozilla exorcises five bugs on Halloween
80. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
81. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices
82. GNOME 3.30.2 released: bugs fix
83. Attackers Use Zero-Day That Can Restart Cisco Security Appliances

Region brief for 2018-11-02

ASIA

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Stuxnet Returns, Striking Iran with New Variant
3. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
4. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
5. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
6. Iran has become victim of a cyberattack campaign
7. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

OCEANIA

Nil

NORTH AMERICA

8. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
9. New Data Affirms Cyber Threat for Industrial Control Systems
10. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
11. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
12. SMS Phishing + Cardless ATM = Profit
13. Stuxnet Returns, Striking Iran with New Variant
14. Bluetooth Bugs Speak to Lack of Security in DevOps
15. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
16. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
17. SamSam ransomware campaigns continue to target U.S. in 2018
18. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
19. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
20. U.S. Geological Survey Network got Infected with Malware
21. 85 million voter records on sale
22. Iran has become victim of a cyberattack campaign
23. EY launches the world's first secure private transactions over the Ethereum public blockchain

SOUTH AMERICA

24. Russian hackers compromise 120 million Facebook accounts; private messages on sale online

EUROPE

25. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
26. Magecart cybergang targeting e-commerce credit card data
27. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
28. Stuxnet Returns, Striking Iran with New Variant
29. Sauter Quickly Patches Flaw in Building Automation Software
30. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
31. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
32. Beware this malware: it can even survive operating systems being reinstalled
33. Magecart claims fresh victim in electronics kit seller Kitronik
34. Iran has become victim of a cyberattack campaign
35. EY launches the world's first secure private transactions over the Ethereum public blockchain

AFRICA

Nil

Sector brief for 2018-11-02

HEALTHCARE

1. ePHI of 8,000 Patients Exposed in Health Plan Breach
2. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures

TRANSPORT

Nil

BANKING & FINANCE

3. Magecart cybergang targeting e-commerce credit card data
4. New Data Affirms Cyber Threat for Industrial Control Systems
5. SMS Phishing + Cardless ATM = Profit
6. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
7. Emotet Trojan Changes Tactics…Again
8. Shipbuilder, defense contractor Austal reveals data breach
9. Data theft at Radisson Hotel Group
10. Trading with cryptocurrencies without losing self control
11. EY launches the world's first secure private transactions over the Ethereum public blockchain

INFORMATION & TELECOMMUNICATION

12. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
13. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
14. New Data Affirms Cyber Threat for Industrial Control Systems
15. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
16. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
17. Bluetooth Bugs Speak to Lack of Security in DevOps
18. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
19. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
20. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
21. Can you spot a malicious email? Take the quiz at
22. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
23. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
24. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
25. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
26. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
27. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
28. 85 million voter records on sale
29. Search for “Installing Chrome” on Bing can lead to malicious content
30. YAPBS – Yet Another Password Breach Scam
31. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers
32. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

FOOD

Nil

WATER

Nil

ENERGY

33. New Data Affirms Cyber Threat for Industrial Control Systems
34. Bluetooth Bugs Speak to Lack of Security in DevOps
35. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
36. Iran has become victim of a cyberattack campaign
37. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices

GOVERNMENT & PUBLIC SERVICE

38. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
39. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
40. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
41. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
42. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
43. U.S. Geological Survey Network got Infected with Malware
44. 85 million voter records on sale
45. Iran has become victim of a cyberattack campaign

Daily brief for 2018-11-02

ASIA

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Stuxnet Returns, Striking Iran with New Variant
3. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
4. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
5. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
6. Iran has become victim of a cyberattack campaign
7. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

WORLD

8. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
9. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
10. Magecart cybergang targeting e-commerce credit card data
11. New Data Affirms Cyber Threat for Industrial Control Systems
12. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
13. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
14. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
15. SMS Phishing + Cardless ATM = Profit
16. Stuxnet Returns, Striking Iran with New Variant
17. Bluetooth Bugs Speak to Lack of Security in DevOps
18. Sauter Quickly Patches Flaw in Building Automation Software
19. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
20. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
21. Beware this malware: it can even survive operating systems being reinstalled
22. Magecart claims fresh victim in electronics kit seller Kitronik
23. SamSam ransomware campaigns continue to target U.S. in 2018
24. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
25. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
26. U.S. Geological Survey Network got Infected with Malware
27. 85 million voter records on sale
28. Iran has become victim of a cyberattack campaign
29. EY launches the world's first secure private transactions over the Ethereum public blockchain

ATTACKS

30. Two botnets are fighting over control of thousands of unsecured Android devices
31. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
32. Spam campaign targets Exodus Mac Users
33. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
34. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
35. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
36. SMS Phishing + Cardless ATM = Profit
37. ePHI of 8,000 Patients Exposed in Health Plan Breach
38. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
39. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
40. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
41. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
42. How to password protect a folder or file in Windows | Avast
43. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
44. SamSam ransomware campaigns continue to target U.S. in 2018
45. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
46. Radisson Hotel Group Hit by Data Breach
47. Spam campaign targets Exodus Mac Users
48. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
49. Shipbuilder, defense contractor Austal reveals data breach
50. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
51. Data theft at Radisson Hotel Group
52. 85 million voter records on sale
53. Iran has become victim of a cyberattack campaign
54. YAPBS – Yet Another Password Breach Scam
55. Apache HBase 2.1.1 release, distributed database
56. FIFA admits hack and braces for new leaks

THREATS

57. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
58. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
59. ​The day computer security turned real: The Morris Worm turns 30
60. Worst Malware and Threat Actors of 2018
61. Cisco Security Appliance Zero-Day Found Actively Exploited in the Wild
62. New Ransomware using DiskCryptor With Custom Ransom Message
63. BLEEDINGBIT – Two Zero Day Vulnerabilities Affecting Wireless Access Point Bluetooth Chips
64. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
65. Hackers actively exploiting vulnerabilities in Cisco security appliances
66. Cisco fixed the high-risk security vulnerabilities in variant products
67. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
68. Bluetooth Bugs Speak to Lack of Security in DevOps
69. Sauter Quickly Patches Flaw in Building Automation Software
70. Bleedingbit vulnerabilities put Wi-Fi access points at risk
71. Adversaries Distribute Malware Via Rarely Used Extensions
72. Test IO introduces Bug Fix Confirmation, leveraging network of software testers to verify bug fixes
73. Can you spot a malicious email? Take the quiz at
74. Antimalware Day: The evolution of malicious code
75. Flaw in Sophos HitmanPro.Alert could enable hackers to gain privileges over systems
76. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
77. Intel CPUs impacted by new PortSmash side-channel vulnerability
78. Beware this malware: it can even survive operating systems being reinstalled
79. SamSam ransomware campaigns continue to target U.S. in 2018
80. CISCO warn of a zero-day DoS flaw that is being actively exploited in attacks
81. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes
82. .@ArmisSecurity researchers discovered two chip-level #Bluetooth vulnerabilities -- dubbed #Bleedingbit -- that could allow pseudo #RemoteCodeExecution on wireless access points.
83. Cisco Reports SIP Inspection Vulnerability
84. Kraken ransomware gets packaged into Fallout EK
85. Emotet Trojan Changes Tactics…Again
86. Mozilla exorcises five bugs on Halloween
87. Giant ransomware bundle threatens to make malware attacks easier for crooks
88. Blockwatch: The aeternity Blockchain
89. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
90. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
91. U.S. Geological Survey Network got Infected with Malware
92. Trading with cryptocurrencies without losing self control
93. EY launches the world's first secure private transactions over the Ethereum public blockchain
94. Search for “Installing Chrome” on Bing can lead to malicious content
95. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices
96. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers
97. GNOME 3.30.2 released: bugs fix
98. Attackers Use Zero-Day That Can Restart Cisco Security Appliances
99. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

CRIME

100. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
101. Magecart cybergang targeting e-commerce credit card data
102. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
103. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
104. SMS Phishing + Cardless ATM = Profit
105. Stuxnet Returns, Striking Iran with New Variant
106. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
107. How to password protect a folder or file in Windows | Avast
108. Beware this malware: it can even survive operating systems being reinstalled
109. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
110. Radisson Hotel Group Hit by Data Breach
111. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
112. Emotet Trojan Changes Tactics…Again
113. Shipbuilder, defense contractor Austal reveals data breach
114. Data theft at Radisson Hotel Group
115. 85 million voter records on sale
116. Iran has become victim of a cyberattack campaign
117. Trading with cryptocurrencies without losing self control
118. EY launches the world's first secure private transactions over the Ethereum public blockchain
119. YAPBS – Yet Another Password Breach Scam
120. FIFA admits hack and braces for new leaks

POLITICS

121. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
122. Spam campaign targets Exodus Mac Users
123. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
124. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
125. Beware this malware: it can even survive operating systems being reinstalled
126. Emotet Trojan Changes Tactics…Again
127. 85 million voter records on sale
128. Iran has become victim of a cyberattack campaign

APT report for 2018-11-02

TRANSNATIONAL / UNKNOWN

1. Magecart cybergang targeting e-commerce credit card data
2. Magecart claims fresh victim in electronics kit seller Kitronik

CHINA

3. Beware this malware: it can even survive operating systems being reinstalled

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

4. New Data Affirms Cyber Threat for Industrial Control Systems
5. Beware this malware: it can even survive operating systems being reinstalled

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-11-02

WINDOWS

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Spam campaign targets Exodus Mac Users
3. New Data Affirms Cyber Threat for Industrial Control Systems
4. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
5. How to password protect a folder or file in Windows | Avast
6. Beware this malware: it can even survive operating systems being reinstalled
7. Search for “Installing Chrome” on Bing can lead to malicious content

LINUX

8. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
9. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
10. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes

UNIX

Nil

ANDROID

11. Two botnets are fighting over control of thousands of unsecured Android devices
12. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities

IOS

Nil

MACOS

13. Spam campaign targets Exodus Mac Users
14. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures

Threat report for 2018-11-02

DATA BREACH & DATA LOSS

1. Two botnets are fighting over control of thousands of unsecured Android devices
2. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
3. Spam campaign targets Exodus Mac Users
4. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
5. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
6. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
7. ePHI of 8,000 Patients Exposed in Health Plan Breach
8. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
9. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
10. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
11. SamSam ransomware campaigns continue to target U.S. in 2018
12. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
13. Radisson Hotel Group Hit by Data Breach
14. Spam campaign targets Exodus Mac Users
15. Shipbuilder, defense contractor Austal reveals data breach
16. Data theft at Radisson Hotel Group
17. 85 million voter records on sale
18. Iran has become victim of a cyberattack campaign
19. Apache HBase 2.1.1 release, distributed database
20. FIFA admits hack and braces for new leaks

DENIAL-OF-SERVICE

21. ThreatList: Fewer Big DDoS Attacks in Q3, Overall Rate Holds Steady
22. Bushido Botnet and DDoS-for-Hire

MALVERTISING

Nil

PHISHING

23. SMS Phishing + Cardless ATM = Profit
24. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
25. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
26. How to password protect a folder or file in Windows | Avast
27. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
28. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
29. YAPBS – Yet Another Password Breach Scam

WEB DEFACEMENT

Nil

BOTNET

30. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
31. Bushido Botnet and DDoS-for-Hire
32. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
33. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
34. 'Outlaw' threat actor uses Shellbot variant to form new botnet

RANSOMWARE

35. New Ransomware using DiskCryptor With Custom Ransom Message
36. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
37. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
38. SamSam ransomware campaigns continue to target U.S. in 2018
39. Kraken ransomware gets packaged into Fallout EK
40. Giant ransomware bundle threatens to make malware attacks easier for crooks

CRYPTOMINING & CRYPTOCURRENCIES

41. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
42. Kraken ransomware gets packaged into Fallout EK
43. Blockwatch: The aeternity Blockchain
44. Trading with cryptocurrencies without losing self control
45. EY launches the world's first secure private transactions over the Ethereum public blockchain
46. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

MALWARE

47. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
48. ​The day computer security turned real: The Morris Worm turns 30
49. Worst Malware and Threat Actors of 2018
50. Adversaries Distribute Malware Via Rarely Used Extensions
51. Can you spot a malicious email? Take the quiz at
52. Antimalware Day: The evolution of malicious code
53. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
54. Beware this malware: it can even survive operating systems being reinstalled
55. Emotet Trojan Changes Tactics…Again
56. Giant ransomware bundle threatens to make malware attacks easier for crooks
57. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
58. U.S. Geological Survey Network got Infected with Malware
59. Search for “Installing Chrome” on Bing can lead to malicious content
60. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers

EXPLOIT

61. Kraken ransomware gets packaged into Fallout EK
62. How to Perform Manual SQL Injection With Double quotes Error Based String Method
63. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these

VULNERABILITY

64. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
65. Cisco Security Appliance Zero-Day Found Actively Exploited in the Wild
66. BLEEDINGBIT – Two Zero Day Vulnerabilities Affecting Wireless Access Point Bluetooth Chips
67. Hackers actively exploiting vulnerabilities in Cisco security appliances
68. Cisco fixed the high-risk security vulnerabilities in variant products
69. Bluetooth Bugs Speak to Lack of Security in DevOps
70. Sauter Quickly Patches Flaw in Building Automation Software
71. Bleedingbit vulnerabilities put Wi-Fi access points at risk
72. Test IO introduces Bug Fix Confirmation, leveraging network of software testers to verify bug fixes
73. Flaw in Sophos HitmanPro.Alert could enable hackers to gain privileges over systems
74. Intel CPUs impacted by new PortSmash side-channel vulnerability
75. CISCO warn of a zero-day DoS flaw that is being actively exploited in attacks
76. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes
77. .@ArmisSecurity researchers discovered two chip-level #Bluetooth vulnerabilities -- dubbed #Bleedingbit -- that could allow pseudo #RemoteCodeExecution on wireless access points.
78. Cisco Reports SIP Inspection Vulnerability
79. Mozilla exorcises five bugs on Halloween
80. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
81. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices
82. GNOME 3.30.2 released: bugs fix
83. Attackers Use Zero-Day That Can Restart Cisco Security Appliances

Region brief for 2018-11-02

ASIA

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Stuxnet Returns, Striking Iran with New Variant
3. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
4. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
5. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
6. Iran has become victim of a cyberattack campaign
7. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

OCEANIA

Nil

NORTH AMERICA

8. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
9. New Data Affirms Cyber Threat for Industrial Control Systems
10. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
11. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
12. SMS Phishing + Cardless ATM = Profit
13. Stuxnet Returns, Striking Iran with New Variant
14. Bluetooth Bugs Speak to Lack of Security in DevOps
15. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
16. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
17. SamSam ransomware campaigns continue to target U.S. in 2018
18. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
19. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
20. U.S. Geological Survey Network got Infected with Malware
21. 85 million voter records on sale
22. Iran has become victim of a cyberattack campaign
23. EY launches the world's first secure private transactions over the Ethereum public blockchain

SOUTH AMERICA

24. Russian hackers compromise 120 million Facebook accounts; private messages on sale online

EUROPE

25. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
26. Magecart cybergang targeting e-commerce credit card data
27. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
28. Stuxnet Returns, Striking Iran with New Variant
29. Sauter Quickly Patches Flaw in Building Automation Software
30. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
31. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
32. Beware this malware: it can even survive operating systems being reinstalled
33. Magecart claims fresh victim in electronics kit seller Kitronik
34. Iran has become victim of a cyberattack campaign
35. EY launches the world's first secure private transactions over the Ethereum public blockchain

AFRICA

Nil

Sector brief for 2018-11-02

HEALTHCARE

1. ePHI of 8,000 Patients Exposed in Health Plan Breach
2. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures

TRANSPORT

Nil

BANKING & FINANCE

3. Magecart cybergang targeting e-commerce credit card data
4. New Data Affirms Cyber Threat for Industrial Control Systems
5. SMS Phishing + Cardless ATM = Profit
6. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
7. Emotet Trojan Changes Tactics…Again
8. Shipbuilder, defense contractor Austal reveals data breach
9. Data theft at Radisson Hotel Group
10. Trading with cryptocurrencies without losing self control
11. EY launches the world's first secure private transactions over the Ethereum public blockchain

INFORMATION & TELECOMMUNICATION

12. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
13. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
14. New Data Affirms Cyber Threat for Industrial Control Systems
15. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
16. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
17. Bluetooth Bugs Speak to Lack of Security in DevOps
18. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
19. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
20. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
21. Can you spot a malicious email? Take the quiz at
22. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
23. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
24. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
25. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
26. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
27. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
28. 85 million voter records on sale
29. Search for “Installing Chrome” on Bing can lead to malicious content
30. YAPBS – Yet Another Password Breach Scam
31. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers
32. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

FOOD

Nil

WATER

Nil

ENERGY

33. New Data Affirms Cyber Threat for Industrial Control Systems
34. Bluetooth Bugs Speak to Lack of Security in DevOps
35. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
36. Iran has become victim of a cyberattack campaign
37. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices

GOVERNMENT & PUBLIC SERVICE

38. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
39. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
40. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
41. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
42. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
43. U.S. Geological Survey Network got Infected with Malware
44. 85 million voter records on sale
45. Iran has become victim of a cyberattack campaign