APT report for 2018-11-07

TRANSNATIONAL / UNKNOWN

1. Feds get guilty plea in 'DerpTrolling' attacks on video game sites
2. Goblin Panda
3. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts

CHINA

Nil

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

Nil

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-11-07

WINDOWS

1. Evernote Flaw Allows Hackers to Steal Files, Execute Commands
2. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
3. Erratic Windows 10 Bug Breaks Changing of Default File Associations
4. Researcher discloses VirtualBox Zero-Day without reporting it to Oracle
5. Serious XSS flaw discovered in Evernote for Windows, update now!
6. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
7. Linux servers and IoT devices, main targets of Shellbot botnet
8. Vulnerabilities in self encrypted SSD allow attackers to bypass disk encryption

LINUX

9. Researcher discloses VirtualBox Zero-Day without reporting it to Oracle
10. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
11. Linux servers and IoT devices, main targets of Shellbot botnet

UNIX

Nil

ANDROID

12. 3,2 Million New Android Malicious Apps Detected Until the End of Q3 2018
13. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
14. Not sure how to tell if your Android phone has a virus? Android malware comes in many forms, ranging from spyware
15. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
16. November Android Security Update Fixes Critical Bugs, Drops Media Library
17. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
18. Linux servers and IoT devices, main targets of Shellbot botnet

IOS

19. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts

MACOS

20. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts

Threat report for 2018-11-07

DATA BREACH & DATA LOSS

1. New Jersey AG Announces $200,000 Settlement with Business Associate and Permanent Ban for BA’s Owner due to 2016 Data Breach Affecting Over 1,650 Patients
2. Half a Million People Potentially Affected by Data Breach at Bankers Life
3. Data Of Nearly 700,000 Amex India Customers Exposed Via Unsecured MongoDB Server
4. HSBC Bank Suffers Data Breach
5. Amex India accounts exposed by misconfigured MongoDB installation
6. Data of nearly 700,000 Amex India customers exposed via unsecured MongoDB server
7. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
8. HSBC Bank Data Breach Exposed Customer’s Account Details and More
9. HSBC US Customers Hit by Data Breach
10. What do you think is the average cost of a data breach?
11. HSBC now stands for Hapless Security, Became Compromised: Thousands of customer files snatched by crims
12. ICO poised to fine Leave campaign and Arron Banks’ insurance biz £135,000
13. HSBC suffers data breach, customer banking info exposed
14. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
15. New dropper campaign with at least 8 droppers in #GooglePlay (30k+ installs total), found with the help of @avast_antivirus @apklabio.
16. How voting history data benefits political campaigns
17. HSBC Bank Data Breach Exposed Account Numbers, Balances, Transaction History and Other Details
18. Personal data of police and ministries employees leaked by Anonymous Italy
19. Five Guys suffers employees’ data theft
20. Rushed My Health Record changes still missing the point
21. What businesses can learn from political campaigns about using big data

DENIAL-OF-SERVICE

Nil

MALVERTISING

Nil

PHISHING

22. A Phishing Incident is Being Investigated by the Carthage Police
23. Why you should use a password manager
24. They stopped a phishing attack in 10 minutes. It used to take days.
25. Password Grabber Module Added to Trickbot
26. Why Password Management and Security Strategies Fall Short
27. Learn About Phishing Incident Response on Nov 15
28. Learn why @Google chose U2F authentication over OTP to eliminate #PhishingEmails from expert Michael Cobb of @thehairyITdog.
29. A poor password is a key for the wrong person to get in.

WEB DEFACEMENT

Nil

BOTNET

30. IoT Botnet Infects 100,000 Routers To Send Spam
31. Rapidly Growing Router Botnet Takes Advantage of 5-Year-Old Flaw
32. IoT botnet infects 100,000 routers to send Hotmail, Outlook, and Yahoo spam
33. A fresh #botnet is rapidly growing by targeting a five-year-old #vulnerability. So far, @360Netlab said hundreds of thousands of bot
34. Linux servers and IoT devices, main targets of Shellbot botnet

RANSOMWARE

35. Healthcare Targeted by 37 Percent of All Ransomware Attacks in Q3 2018
36. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
37. #SamSam #ransomware targeted 67 organizations in 2018, according to @symantec research. By @MaddieBacon11
38. How to Remove NOBAD Ransomware
39. #Kraken #ransomware as a service is getting more popular after being bundled into the Fallout #ExploitKit and getting more update
40. Managing Third-Party Risk in the Age of Ransomware

CRYPTOMINING & CRYPTOCURRENCIES

41. Uni cans crypto-mining CPU raid by switching off whole IT network
42. Salesforce Aims to Curb Spam With Blockchain
43. Using Blockchain Technology to Solve Global Problems
44. JavaScript attack aimed to reroute bitcoin transactions
45. University shuts down network to thwart Bitcoin cryptojacking scheme
46. Attackers breached Statcounter to steal cryptocurrency from gate.io users
47. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
48. #Kraken #ransomware as a service is getting more popular after being bundled into the Fallout #ExploitKit and getting more update
49. Hackers seed StatCounter with nasty JavaScript in elaborate Bitcoin theft scheme
50. Blockchain: The Good, the Bad and the Legal
51. New cryptocurrencies offer better anonymity, new security challenges, from @CSOonline http://0fox.co/sSmx30i8vm4 ZeroFOX CTO weighs in on the #infosec challenges
52. Bitcoin Cryptojacking Attack Forces University to Disable Entire Network
53. Researchers rank cryptocurrency exchanges by how secure they are

MALWARE

54. Cisco removed its seventh backdoor account this year, and that's a good thing
55. 3,2 Million New Android Malicious Apps Detected Until the End of Q3 2018
56. Not sure how to tell if your Android phone has a virus? Android malware comes in many forms, ranging from spyware
57. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
58. On the #blog today, we talk about how fileless malware is changing the way we as organizations treats #cyberthreats.
59. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
60. New dropper campaign with at least 8 droppers in #GooglePlay (30k+ installs total), found with the help of @avast_antivirus @apklabio.
61. Coupa Simplifies Fragmented B2B Payments Process
62. Turning Malware Trends into Proactive Behaviors
63. DHS on Election Day: No malicious cyber-activity observed
64. AMD and TSMC outline 7nm process products to be listed next year

EXPLOIT

65. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
66. VirtualBox Guest-to-Host escape 0day and exploit released online
67. According to @digitalshadows, attackers used a browser exploit to steal the private #Facebook messages of at least 81,000 people. Read
68. #Virtualbox hat eine #Zeroday Sicherheitslücke. Tipp: Ändern Sie Ihren virtuellen Netzwerkadapter auf etwas anderes als Intel PRO/1000.
69. VirtualBox Zero-Day Vulnerability Details and Exploit Are Publicly Available

VULNERABILITY

70. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
71. Security Flaws Found in Widely Used Data Storage Devices | Avast
72. A flaw in WooCommerce WordPress Plugin could be exploited to take over e-stores
73. Flaw in Icecast streaming media server allows to take off online Radio Stations
74. VirtualBox zero-day dumped on GitHub
75. Security Researcher Drops VirtualBox Guest-to-Host Escape Zero-Day on GitHub
76. WordPress Flaw Opens Millions of WooCommerce Shops to Takeover
77. Rapidly Growing Router Botnet Takes Advantage of 5-Year-Old Flaw
78. Flaw Leads to RCE in WordPress Plugins, WooCommerce
79. Hacker education, inclusivity, and shifting perceptions of bug bounties
80. Apache alerts developers of remote code execution flaw
81. Evernote Flaw Allows Hackers to Steal Files, Execute Commands
82. Top 20 application vulnerabilities in the enterprise are dominated by Adobe and Microsoft
83. Equifax nemesis Apache Struts found vulnerable to 2-year old unpatched flaw; workaround available
84. Rapid7 Wins Frost & Sullivan 2018 Global Vulnerability Management Market Leadership Award
85. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
86. Zero-day flaw in VirtualBox details go public
87. Erratic Windows 10 Bug Breaks Changing of Default File Associations
88. Researcher discloses VirtualBox Zero-Day without reporting it to Oracle
89. Serious XSS flaw discovered in Evernote for Windows, update now!
90. Researchers say #Bleedingbit vulnerabilities could allow #RemoteCodeExecution on wireless access points, medical devices and any other products using the affected
91. Enterprises Sinking Under 100+ Critical Flaws Per Day
92. WordPress, WooCommerce flaws combine to allow website hijacking
93. Apache Struts vulnerability would allow system take over
94. Up to 4 million online merchants who use the popular @WooCommerce #WordPress plugin are vulnerable to a file deletion flaw.
95. Researcher Drops Oracle VirtualBox Zero-Day
96. Stop us if you've heard this one: Remote code hijacking flaw in Apache Struts, patch ASAP
97. Bug bounty: Hack the US Air Force and Get Paid
98. Microsoft, Google apps feature in the top 20 vulnerabilities in enterprise environments
99. VirtualBox zero-day published by disgruntled researcher
100. A fresh #botnet is rapidly growing by targeting a five-year-old #vulnerability. So far, @360Netlab said hundreds of thousands of bot
101. .@Siemens SICLOCK central plant clocks were recently found to be affected by several vulnerabilities, some of which have been rated
102. Apache Struts users have to update FileUpload library to fix years-old flaws
103. Zero-Day #Vulnerability Explained
104. November Android Security Update Fixes Critical Bugs, Drops Media Library
105. Researcher publishes new VirtualBox zero-day vulnerability
106. Vulnerabilities in self encrypted SSD allow attackers to bypass disk encryption
107. #Virtualbox hat eine #Zeroday Sicherheitslücke. Tipp: Ändern Sie Ihren virtuellen Netzwerkadapter auf etwas anderes als Intel PRO/1000.
108. Popular WooCommerce WordPress Plugin Patches Critical Vulnerability
109. Google's automated fuzz bot has found over 9,000 bugs in the past two years
110. VirtualBox Zero-Day Vulnerability Details and Exploit Are Publicly Available

Region brief for 2018-11-07

ASIA

1. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
2. Data Of Nearly 700,000 Amex India Customers Exposed Via Unsecured MongoDB Server
3. Amex India accounts exposed by misconfigured MongoDB installation
4. Data of nearly 700,000 Amex India customers exposed via unsecured MongoDB server
5. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
6. Personal data of police and ministries employees leaked by Anonymous Italy
7. Linux servers and IoT devices, main targets of Shellbot botnet

OCEANIA

8. Rushed My Health Record changes still missing the point

NORTH AMERICA

9. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
10. Salesforce Aims to Curb Spam With Blockchain
11. Using Blockchain Technology to Solve Global Problems
12. Feds get guilty plea in 'DerpTrolling' attacks on video game sites
13. Half a Million People Potentially Affected by Data Breach at Bankers Life
14. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
15. Learn About Phishing Incident Response on Nov 15
16. HSBC Bank Data Breach Exposed Customer’s Account Details and More
17. HSBC US Customers Hit by Data Breach
18. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
19. Stop us if you've heard this one: Remote code hijacking flaw in Apache Struts, patch ASAP
20. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
21. HSBC suffers data breach, customer banking info exposed
22. Bug bounty: Hack the US Air Force and Get Paid
23. Personal data of police and ministries employees leaked by Anonymous Italy
24. AMD and TSMC outline 7nm process products to be listed next year
25. Five Guys suffers employees’ data theft
26. Bitcoin Cryptojacking Attack Forces University to Disable Entire Network

SOUTH AMERICA

Nil

EUROPE

27. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
28. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
29. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
30. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
31. VirtualBox zero-day published by disgruntled researcher
32. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
33. Personal data of police and ministries employees leaked by Anonymous Italy
34. Linux servers and IoT devices, main targets of Shellbot botnet
35. Five Guys suffers employees’ data theft
36. Vulnerabilities in self encrypted SSD allow attackers to bypass disk encryption
37. VirtualBox Zero-Day Vulnerability Details and Exploit Are Publicly Available

AFRICA

Nil

Sector brief for 2018-11-07

HEALTHCARE

1. New Jersey AG Announces $200,000 Settlement with Business Associate and Permanent Ban for BA’s Owner due to 2016 Data Breach Affecting Over 1,650 Patients
2. Healthcare Targeted by 37 Percent of All Ransomware Attacks in Q3 2018
3. Researchers say #Bleedingbit vulnerabilities could allow #RemoteCodeExecution on wireless access points, medical devices and any other products using the affected
4. Managing Third-Party Risk in the Age of Ransomware

TRANSPORT

Nil

BANKING & FINANCE

5. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
6. New Jersey AG Announces $200,000 Settlement with Business Associate and Permanent Ban for BA’s Owner due to 2016 Data Breach Affecting Over 1,650 Patients
7. Half a Million People Potentially Affected by Data Breach at Bankers Life
8. Healthcare Targeted by 37 Percent of All Ransomware Attacks in Q3 2018
9. HSBC Bank Suffers Data Breach
10. A Phishing Incident is Being Investigated by the Carthage Police
11. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
12. They stopped a phishing attack in 10 minutes. It used to take days.
13. Password Grabber Module Added to Trickbot
14. HSBC Bank Data Breach Exposed Customer’s Account Details and More
15. HSBC US Customers Hit by Data Breach
16. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
17. Hackers seed StatCounter with nasty JavaScript in elaborate Bitcoin theft scheme
18. HSBC now stands for Hapless Security, Became Compromised: Thousands of customer files snatched by crims
19. ICO poised to fine Leave campaign and Arron Banks’ insurance biz £135,000
20. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
21. HSBC suffers data breach, customer banking info exposed
22. Bug bounty: Hack the US Air Force and Get Paid
23. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
24. Coupa Simplifies Fragmented B2B Payments Process
25. HSBC Bank Data Breach Exposed Account Numbers, Balances, Transaction History and Other Details

INFORMATION & TELECOMMUNICATION

26. Feds get guilty plea in 'DerpTrolling' attacks on video game sites
27. Flaw in Icecast streaming media server allows to take off online Radio Stations
28. IoT botnet infects 100,000 routers to send Hotmail, Outlook, and Yahoo spam
29. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
30. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
31. On the #blog today, we talk about how fileless malware is changing the way we as organizations treats #cyberthreats.
32. According to @digitalshadows, attackers used a browser exploit to steal the private #Facebook messages of at least 81,000 people. Read
33. New dropper campaign with at least 8 droppers in #GooglePlay (30k+ installs total), found with the help of @avast_antivirus @apklabio.
34. Linux servers and IoT devices, main targets of Shellbot botnet

FOOD

Nil

WATER

Nil

ENERGY

35. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
36. Personal data of police and ministries employees leaked by Anonymous Italy

GOVERNMENT & PUBLIC SERVICE

37. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
38. Feds get guilty plea in 'DerpTrolling' attacks on video game sites
39. A Phishing Incident is Being Investigated by the Carthage Police
40. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
41. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
42. DHS on Election Day: No malicious cyber-activity observed
43. How voting history data benefits political campaigns
44. Personal data of police and ministries employees leaked by Anonymous Italy
45. Linux servers and IoT devices, main targets of Shellbot botnet
46. Rushed My Health Record changes still missing the point
47. What businesses can learn from political campaigns about using big data

Daily brief for 2018-11-07

ASIA

1. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
2. Data Of Nearly 700,000 Amex India Customers Exposed Via Unsecured MongoDB Server
3. Amex India accounts exposed by misconfigured MongoDB installation
4. Data of nearly 700,000 Amex India customers exposed via unsecured MongoDB server
5. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
6. Personal data of police and ministries employees leaked by Anonymous Italy
7. Linux servers and IoT devices, main targets of Shellbot botnet

WORLD

8. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
9. Salesforce Aims to Curb Spam With Blockchain
10. Using Blockchain Technology to Solve Global Problems
11. Feds get guilty plea in 'DerpTrolling' attacks on video game sites
12. Half a Million People Potentially Affected by Data Breach at Bankers Life
13. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
14. Learn About Phishing Incident Response on Nov 15
15. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
16. HSBC Bank Data Breach Exposed Customer’s Account Details and More
17. HSBC US Customers Hit by Data Breach
18. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
19. Stop us if you've heard this one: Remote code hijacking flaw in Apache Struts, patch ASAP
20. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
21. HSBC suffers data breach, customer banking info exposed
22. Bug bounty: Hack the US Air Force and Get Paid
23. VirtualBox zero-day published by disgruntled researcher
24. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
25. Personal data of police and ministries employees leaked by Anonymous Italy
26. Linux servers and IoT devices, main targets of Shellbot botnet
27. AMD and TSMC outline 7nm process products to be listed next year
28. Five Guys suffers employees’ data theft
29. Vulnerabilities in self encrypted SSD allow attackers to bypass disk encryption
30. Bitcoin Cryptojacking Attack Forces University to Disable Entire Network
31. Rushed My Health Record changes still missing the point
32. VirtualBox Zero-Day Vulnerability Details and Exploit Are Publicly Available

ATTACKS

33. New Jersey AG Announces $200,000 Settlement with Business Associate and Permanent Ban for BA’s Owner due to 2016 Data Breach Affecting Over 1,650 Patients
34. Half a Million People Potentially Affected by Data Breach at Bankers Life
35. Data Of Nearly 700,000 Amex India Customers Exposed Via Unsecured MongoDB Server
36. HSBC Bank Suffers Data Breach
37. A Phishing Incident is Being Investigated by the Carthage Police
38. Why you should use a password manager
39. Amex India accounts exposed by misconfigured MongoDB installation
40. They stopped a phishing attack in 10 minutes. It used to take days.
41. Password Grabber Module Added to Trickbot
42. Data of nearly 700,000 Amex India customers exposed via unsecured MongoDB server
43. Why Password Management and Security Strategies Fall Short
44. Learn About Phishing Incident Response on Nov 15
45. Learn why @Google chose U2F authentication over OTP to eliminate #PhishingEmails from expert Michael Cobb of @thehairyITdog.
46. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
47. HSBC Bank Data Breach Exposed Customer’s Account Details and More
48. HSBC US Customers Hit by Data Breach
49. What do you think is the average cost of a data breach?
50. HSBC now stands for Hapless Security, Became Compromised: Thousands of customer files snatched by crims
51. ICO poised to fine Leave campaign and Arron Banks’ insurance biz £135,000
52. HSBC suffers data breach, customer banking info exposed
53. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
54. New dropper campaign with at least 8 droppers in #GooglePlay (30k+ installs total), found with the help of @avast_antivirus @apklabio.
55. A poor password is a key for the wrong person to get in.
56. How voting history data benefits political campaigns
57. HSBC Bank Data Breach Exposed Account Numbers, Balances, Transaction History and Other Details
58. Personal data of police and ministries employees leaked by Anonymous Italy
59. Five Guys suffers employees’ data theft
60. Rushed My Health Record changes still missing the point
61. What businesses can learn from political campaigns about using big data

THREATS

62. Uni cans crypto-mining CPU raid by switching off whole IT network
63. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
64. Security Flaws Found in Widely Used Data Storage Devices | Avast
65. Salesforce Aims to Curb Spam With Blockchain
66. Using Blockchain Technology to Solve Global Problems
67. Cisco removed its seventh backdoor account this year, and that's a good thing
68. JavaScript attack aimed to reroute bitcoin transactions
69. 3,2 Million New Android Malicious Apps Detected Until the End of Q3 2018
70. A flaw in WooCommerce WordPress Plugin could be exploited to take over e-stores
71. Healthcare Targeted by 37 Percent of All Ransomware Attacks in Q3 2018
72. Flaw in Icecast streaming media server allows to take off online Radio Stations
73. VirtualBox zero-day dumped on GitHub
74. Security Researcher Drops VirtualBox Guest-to-Host Escape Zero-Day on GitHub
75. WordPress Flaw Opens Millions of WooCommerce Shops to Takeover
76. Rapidly Growing Router Botnet Takes Advantage of 5-Year-Old Flaw
77. Flaw Leads to RCE in WordPress Plugins, WooCommerce
78. Hacker education, inclusivity, and shifting perceptions of bug bounties
79. Apache alerts developers of remote code execution flaw
80. Evernote Flaw Allows Hackers to Steal Files, Execute Commands
81. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
82. Top 20 application vulnerabilities in the enterprise are dominated by Adobe and Microsoft
83. Equifax nemesis Apache Struts found vulnerable to 2-year old unpatched flaw; workaround available
84. Rapid7 Wins Frost & Sullivan 2018 Global Vulnerability Management Market Leadership Award
85. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
86. Zero-day flaw in VirtualBox details go public
87. Erratic Windows 10 Bug Breaks Changing of Default File Associations
88. Researcher discloses VirtualBox Zero-Day without reporting it to Oracle
89. Serious XSS flaw discovered in Evernote for Windows, update now!
90. Researchers say #Bleedingbit vulnerabilities could allow #RemoteCodeExecution on wireless access points, medical devices and any other products using the affected
91. University shuts down network to thwart Bitcoin cryptojacking scheme
92. Not sure how to tell if your Android phone has a virus? Android malware comes in many forms, ranging from spyware
93. Attackers breached Statcounter to steal cryptocurrency from gate.io users
94. Enterprises Sinking Under 100+ Critical Flaws Per Day
95. #SamSam #ransomware targeted 67 organizations in 2018, according to @symantec research. By @MaddieBacon11
96. WordPress, WooCommerce flaws combine to allow website hijacking
97. How to Remove NOBAD Ransomware
98. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
99. Apache Struts vulnerability would allow system take over
100. #Kraken #ransomware as a service is getting more popular after being bundled into the Fallout #ExploitKit and getting more update
101. Up to 4 million online merchants who use the popular @WooCommerce #WordPress plugin are vulnerable to a file deletion flaw.
102. Researcher Drops Oracle VirtualBox Zero-Day
103. Stop us if you've heard this one: Remote code hijacking flaw in Apache Struts, patch ASAP
104. Hackers seed StatCounter with nasty JavaScript in elaborate Bitcoin theft scheme
105. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
106. Blockchain: The Good, the Bad and the Legal
107. Managing Third-Party Risk in the Age of Ransomware
108. Bug bounty: Hack the US Air Force and Get Paid
109. Microsoft, Google apps feature in the top 20 vulnerabilities in enterprise environments
110. VirtualBox zero-day published by disgruntled researcher
111. A fresh #botnet is rapidly growing by targeting a five-year-old #vulnerability. So far, @360Netlab said hundreds of thousands of bot
112. .@Siemens SICLOCK central plant clocks were recently found to be affected by several vulnerabilities, some of which have been rated
113. New cryptocurrencies offer better anonymity, new security challenges, from @CSOonline http://0fox.co/sSmx30i8vm4 ZeroFOX CTO weighs in on the #infosec challenges
114. Apache Struts users have to update FileUpload library to fix years-old flaws
115. On the #blog today, we talk about how fileless malware is changing the way we as organizations treats #cyberthreats.
116. Zero-Day #Vulnerability Explained
117. November Android Security Update Fixes Critical Bugs, Drops Media Library
118. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
119. New dropper campaign with at least 8 droppers in #GooglePlay (30k+ installs total), found with the help of @avast_antivirus @apklabio.
120. Coupa Simplifies Fragmented B2B Payments Process
121. Researcher publishes new VirtualBox zero-day vulnerability
122. Turning Malware Trends into Proactive Behaviors
123. DHS on Election Day: No malicious cyber-activity observed
124. AMD and TSMC outline 7nm process products to be listed next year
125. Vulnerabilities in self encrypted SSD allow attackers to bypass disk encryption
126. #Virtualbox hat eine #Zeroday Sicherheitslücke. Tipp: Ändern Sie Ihren virtuellen Netzwerkadapter auf etwas anderes als Intel PRO/1000.
127. Bitcoin Cryptojacking Attack Forces University to Disable Entire Network
128. Popular WooCommerce WordPress Plugin Patches Critical Vulnerability
129. Google's automated fuzz bot has found over 9,000 bugs in the past two years
130. VirtualBox Zero-Day Vulnerability Details and Exploit Are Publicly Available
131. Researchers rank cryptocurrency exchanges by how secure they are

CRIME

132. Feds get guilty plea in 'DerpTrolling' attacks on video game sites
133. JavaScript attack aimed to reroute bitcoin transactions
134. A Phishing Incident is Being Investigated by the Carthage Police
135. They stopped a phishing attack in 10 minutes. It used to take days.
136. HSBC Bank Data Breach Exposed Customer’s Account Details and More
137. University shuts down network to thwart Bitcoin cryptojacking scheme
138. Attackers breached Statcounter to steal cryptocurrency from gate.io users
139. HSBC US Customers Hit by Data Breach
140. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
141. Hackers seed StatCounter with nasty JavaScript in elaborate Bitcoin theft scheme
142. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
143. Blockchain: The Good, the Bad and the Legal
144. Coupa Simplifies Fragmented B2B Payments Process
145. Five Guys suffers employees’ data theft

POLITICS

146. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
147. DHS on Election Day: No malicious cyber-activity observed
148. Personal data of police and ministries employees leaked by Anonymous Italy
149. Vulnerabilities in self encrypted SSD allow attackers to bypass disk encryption