Daily brief for 2018-10-04

ASIA

1. Should You Worry About Software Supply Chain Attacks?
2. .@FireEye researchers tracked an aggressive #cybertheft campaign -- attributed to North Korean #APT38 -- in which threat actors attempted to
3. Shedding Skin – Turla’s Fresh Faces
4. China allegedly infiltrated US companies through implanted hardware backdoors
5. Report: In Huge Hack, Chinese Manufacturer Sneaks Backdoors Onto Motherboards
6. Apple, Amazon deny claims Chinese spies implanted backdoor chips in company hardware: report
7. Canadian restaurant chain Recipe suffered a network outage, is it a ransomware attack?
8. A Remote iOS Bug
9. APT38 is behind financially motivated attacks carried out by North Korea
10. Security Investigator who Compromised Hotel Wi-Fi, Shared Pass-Codes Online, is Fined

WORLD

11. UK pins ‘reckless campaign of cyber attacks’ on Russian military intelligence
12. Virus Bulletin 2018: Turla APT Changes Shape with New Code and Targets
13. Should You Worry About Software Supply Chain Attacks?
14. Bug bounty scheme uncovers 150 vulnerabilities in US Marine Corps websites
15. China allegedly infiltrated US companies through implanted hardware backdoors
16. US charges Russian military officers over international hacking and disinformation campaigns
17. LoJack for computers used to attack European government bodies
18. Hacker Pleads Guilty of Defacing 11,000 Websites, Could Get up to 20 Years
19. Justice Department charges 7 Russian intelligence officers
20. CVE-2018-4251 – Apple did not disable Intel Manufacturing Mode in its laptops
21. Russian Fancy Bear APT Linked To Earworm Hacking Group
22. ICYMI - CISO @rickhholland joins @drshellface and @mazzazone in this week's ShadowTalk episode: Security Flaws Affect 50 Million Facebook Accounts
23. HIDDEN COBRA – FASTCash Campaign
24. Pacific Northwest burger chain hit by FIN7
25. Irish Data Regulator Likely to Fine Facebook for Data Breach
26. Russian Fancy Bear APT linked to Earworm hacking group
27. Apple, Amazon deny claims Chinese spies implanted backdoor chips in company hardware: report
28. 5,000 UK firms' financial details exposed in data breaches, finds @digitalshadows
29. Canadian restaurant chain Recipe suffered a network outage, is it a ransomware attack?
30. Burgerville customer credit card info stolen in data breach laid at Fin7's feet
31. LoJax: First UEFI Malware seen in the Wild
32. Hackers Earn $150,000 in Marine Corps Bug Bounty Program
33. APT38 is behind financially motivated attacks carried out by North Korea
34. UK and allies accuse Russia of cyber attack campaign
35. New DanaBot Banking Malware Attack in Various Countries with Stealer and Remote Access Futures
36. Experts recommend avoiding single step logins
37. U.S. Capitol Police Arrest Suspect for Doxing U.S. Senators
38. DanaBot Observed in Large Campaign Targeting U.S. Organizations

ATTACKS

39. UK pins ‘reckless campaign of cyber attacks’ on Russian military intelligence
40. .@FireEye researchers tracked an aggressive #cybertheft campaign -- attributed to North Korean #APT38 -- in which threat actors attempted to
41. Campaign 2018: Cyberattacks on infrastructure could suppress voter turnout
42. Sony accidentally leaked November's PS Plus free games
43. US charges Russian military officers over international hacking and disinformation campaigns
44. Hacker Pleads Guilty of Defacing 11,000 Websites, Could Get up to 20 Years
45. Burgerville Customer Credit Card Info Stolen In Data Breach
46. Exclusive: Moving away from passwords to two-factor authentication
47. HIDDEN COBRA – FASTCash Campaign
48. Database of 200 Million Records Stolen from Apollo in Data Breach
49. Irish Data Regulator Likely to Fine Facebook for Data Breach
50. 5,000 UK firms' financial details exposed in data breaches, finds @digitalshadows
51. The @UN accidentally exposed credentials on public @trello boards. Plus, #Uber is set to pay $148 million settlement following its
52. Burgerville customer credit card info stolen in data breach laid at Fin7's feet
53. Block Blocking Login Items
54. How #livechatsoftware leak personal #employeedata?
55. Democratic congressional intern arrested for doxing GOP senators during Kavanaugh hearing
56. California bill bans bots during elections
57. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
58. Business Email Compromise: When You Don’t Need to Phish.
59. Business email compromise made easy for cyber criminals
60. In manufacturing, almost half – 47 percent – of breaches involve the theft of intellectual property to gain competitive advantage.
61. Hackers Selling Facebook Account Logins Details On Dark Web For $3
62. Security Investigator who Compromised Hotel Wi-Fi, Shared Pass-Codes Online, is Fined
63. UK and allies accuse Russia of cyber attack campaign
64. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials found openly
65. Experts recommend avoiding single step logins
66. Phishing Attacks Distributed Through CloudFlare's IPFS Gateway
67. Why It’s Time to Nuke the Password
68. Why It’s Time to Nuke the Password
69. U.S. Capitol Police Arrest Suspect for Doxing U.S. Senators
70. DanaBot Observed in Large Campaign Targeting U.S. Organizations

THREATS

71. Google Project Zero drops macOS exploit, calls out Apple for silent patching
72. Virus Bulletin 2018: Turla APT Changes Shape with New Code and Targets
73. .@ThreatFabric researchers uncovered an #Android malware, #MysteryBot, which uses overlay attacks to avoid detection. Learn how this #malware affects @Google's
74. Bug bounty scheme uncovers 150 vulnerabilities in US Marine Corps websites
75. China allegedly infiltrated US companies through implanted hardware backdoors
76. Researchers at the 2018 @RSAConference discussed #stegware: @malware that uses #steganography. Discover how this works with expert @lewisnic.
77. Report: In Huge Hack, Chinese Manufacturer Sneaks Backdoors Onto Motherboards
78. Avast AV reclassifies cryptominers | Avast
79. Researchers at Cisco Talos (@TalosSecurity) recently discovered #GravityRAT, a remote access #Trojan. Discover how this RAT can check for
80. CVE-2018-4251 – Apple did not disable Intel Manufacturing Mode in its laptops
81. macOS Flaw Allows Attackers To Hijack Installed Apps
82. ICYMI - CISO @rickhholland joins @drshellface and @mazzazone in this week's ShadowTalk episode: Security Flaws Affect 50 Million Facebook Accounts
83. CVE-2018-8373 Exploit Spotted
84. Vulnerability Scanning vs. Penetration Testing by @TripwireInc
85. This is also a good time to remind that bugdoors are far more scary than backdoors.
86. Fallout Exploit Kit Now Installing the Kraken Cryptor Ransomware
87. Apple, Amazon deny claims Chinese spies implanted backdoor chips in company hardware: report
88. Researchers from @proofpoint have announced the discovery of a remote access trojan, and an upgraded version of an old banking
89. Canadian restaurant chain Recipe suffered a network outage, is it a ransomware attack?
90. Remote Mac Exploitation Via Custom URL Schemes
91. A Remote iOS Bug
92. Tearing Apart the Undetected (OSX)Coldroot RAT
93. An Unpatched Kernel Bug
94. Mac Malware of 2017
95. From the Top to the Bottom; Tracking down CVE-2017-7149
96. WTF is Mughthesec!? poking on a piece of undetected adware
97. OSX/MacRansom; analyzing the latest ransomware to target macs
98. Two Bugs, One Func(), part three
99. Two Bugs, One Func(), part two
100. Two Bugs, One Func(), part one
101. Mac Malware of 2016
102. Towards Generic Ransomware Detection
103. Analysis of an Intrusive Cross-Platform Adware; OSX/Pirrit
104. Analyzing the Anti-Analysis Logic of an Adware Installer
105. Monitoring Process Creation via the Kernel (Part III)
106. Monitoring Process Creation via the Kernel (Part II)
107. Monitoring Process Creation via the Kernel (Part I)
108. CVE-2015-3673: Goodbye Rootpipe...(for now?)
109. More on, "Adware for OS X Distributes Trojans"
110. LoJax: First UEFI Malware seen in the Wild
111. Cisco: Two critical bugs in DNA network software need these urgent patches
112. Virus Bulletin 2018: Attack velocity ramps up
113. Paper over the Kracks: New techniques can bypass WPA2 flaw mitigations
114. Hackers Earn $150,000 in Marine Corps Bug Bounty Program
115. More than 4,000 ransomware attacks occur every day. Secure your company & build your network at #RiskSec with promo code
116. Malicious remote admin tool seemingly linked to KONNI malware, North Korea
117. Betabot trojan packed with anti-malware evasion tools
118. Cisco plugs critical flaws in DNA Center and Prime Infrastructure
119. Marine Corps bug bounty program finds 150 vulnerabilities
120. How is Android Accessibility Service affected by a banking Trojan?
121. How does stegware malware exploit steganography techniques?
122. .@Trustlook Labs discovered an #Android #Trojan stealing data from messaging apps. Learn what #mobilesecurity programs should look for to detect
123. Cisco Talos spotted 18 vulnerabilities in Foxit PDF Reader, 8 in Atlantis World Processor
124. A new group of #malware -- dubbed #GoScanSSH -- was recently discovered by researchers. Learn how this malware works and
125. Secure encrypted #virtualization: How is this technology exploited?
126. Seriously if I could make evil semiconductors I would just replace one which is already present rather than adding it. Show
127. WATCH: Top 5 Viruses of All Time by Security Expert @mikko Hyppönen
128. New DanaBot Banking Malware Attack in Various Countries with Stealer and Remote Access Futures
129. Foxit PDF Reader fixes serious remote code execution vulnerability
130. A Google bug breaks the search results in Safari
131. Researchers found that cheap Android devices were shipped pre-installed backdoors
132. Google opened the .page domain
133. Most Advanced Backdoor Obfuscation and Evasion Technique That used by Hackers
134. Zoho Heavily Used by Keyloggers to Transmit Stolen Data
135. Hacking for good uncovers over 150 Marine Corps web vulnerabilities
136. Network Outage at Some Recipe Unlimited Locations Caused by Malware
137. DanaBot Observed in Large Campaign Targeting U.S. Organizations

CRIME

138. Bug bounty scheme uncovers 150 vulnerabilities in US Marine Corps websites
139. Shedding Skin – Turla’s Fresh Faces
140. Avast AV reclassifies cryptominers | Avast
141. Hacker Pleads Guilty of Defacing 11,000 Websites, Could Get up to 20 Years
142. Justice Department charges 7 Russian intelligence officers
143. CVE-2018-4251 – Apple did not disable Intel Manufacturing Mode in its laptops
144. Burgerville Customer Credit Card Info Stolen In Data Breach
145. HIDDEN COBRA – FASTCash Campaign
146. Pacific Northwest burger chain hit by FIN7
147. Database of 200 Million Records Stolen from Apollo in Data Breach
148. Researchers from @proofpoint have announced the discovery of a remote access trojan, and an upgraded version of an old banking
149. Canadian restaurant chain Recipe suffered a network outage, is it a ransomware attack?
150. Burgerville customer credit card info stolen in data breach laid at Fin7's feet
151. Remote Mac Exploitation Via Custom URL Schemes
152. How is Android Accessibility Service affected by a banking Trojan?
153. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
154. Business Email Compromise: When You Don’t Need to Phish.
155. Business email compromise made easy for cyber criminals
156. APT38 is behind financially motivated attacks carried out by North Korea
157. In manufacturing, almost half – 47 percent – of breaches involve the theft of intellectual property to gain competitive advantage.
158. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials found openly
159. New DanaBot Banking Malware Attack in Various Countries with Stealer and Remote Access Futures
160. Experts recommend avoiding single step logins

POLITICS

161. UK pins ‘reckless campaign of cyber attacks’ on Russian military intelligence
162. Justice Department charges 7 Russian intelligence officers
163. APT28 turns away from election hacking and back to cyberespionage
164. Apple, Amazon deny claims Chinese spies implanted backdoor chips in company hardware: report
165. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
166. APT38 is behind financially motivated attacks carried out by North Korea

APT report for 2018-10-03

TRANSNATIONAL / UNKNOWN

Nothing to report

CHINA

1. DHS aware of ongoing APT attacks on cloud service providers

INDIA

2. See clearly, decide wisely with visibility and management

NORTH KOREA

3. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
4. FireEye unmasks a new North Korean threat group
5. APT38: Details on New North Korean Regime-Backed Threat Group
6. Researchers associated the recently discovered NOKKI Malware to North Korean APT
7. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
8. North Korean HIDDEN COBRA Hackers Using New Attack Called “FASTCash” to Cash-out From ATM Machine

PAKISTAN

Nothing to report

VIETNAM

Nothing to report

IRAN

Nothing to report

LEBANON

Nothing to report

PALESTINE

Nothing to report

SAUDI ARABIA

Nothing to report

UNITED ARAB EMIRATES

Nothing to report

RUSSIA

9. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks

UKRAINE

Nothing to report

Platform report for 2018-10-03

WINDOWS

1. Windows 10 October 2018 Update refines ransomware protection
2. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
3. [SingCERT] Alert on 47 Critical Vulnerabilities in Adobe Acrobat and Adobe Reader
4. Update now: Adobe fixes 85 serious flaws in Acrobat and Reader
5. Labeless Part 6: How to Resolve Obfuscated API Calls in the Ngioweb Proxy Malware
6. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
7. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
8. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
9. Ransomware Hits Port of San Diego
10. CyberSecurity Asean security alert on A Vulnerability in Microsoft Windows JET Database Engine Could Allow for Remote Code Execution
11. Mozilla Firefox 62.0.3 releases: Fixed hangs on macOS Mojave & security bugs

LINUX

Nothing to report

UNIX

12. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide

ANDROID

13. FakeSpy Is Back as Part of New SmiShing Campaign, Adds New Features
14. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
15. Cheap Android Phones and Poor Quality Control Leads to Malware Surprise

IOS

16. Apple iOS 12 Texting Bug Sends Messages To Wrong Contacts

MACOS

17. Virus Bulletin 2018: macOS Flaw Allows Attackers to Hijack Installed Apps
18. The one serious MacBook Pro security flaw that nobody is talking about
19. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
20. Mozilla Firefox 62.0.3 releases: Fixed hangs on macOS Mojave & security bugs

Threat report for 2018-10-03

DATA BREACH

1. FakeSpy Is Back as Part of New SmiShing Campaign, Adds New Features
2. The ultimate fallout from the Facebook data breach could be massive
3. Gwinnett Medical Center Investigates Possible Data Breach
4. Gwinnett Medical Center investigates possible data breach
5. GhostDNS hijacking campaign steps up attacks on Brazilians; 100K+ devices compromised
6. #DanaBot Observed in Large Campaign Targeting U.S. Organizations
7. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
8. Facebook Reveals That Trio of Bugs Led to Data Breach
9. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
10. New Danabot Banking Malware campaign now targets banks in the U.S.
11. Zoho domains central to keylogger, data theft campaigns worldwide
12. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
13. .@Lookout’s @VijayaKaza is at @FedNewsRadio’s studio recording with @gschumm!
14. How Ashley Madison Recovered From Its Massive Data Breach
15. An extremely high number of keylogger #phishing campaigns have been seen tied to the Zoho online office suite software:
16. New Betabot campaign under the microscope
17. CyberSecurity Asean security alert on A Vulnerability in Microsoft Windows JET Database Engine Could Allow for Remote Code Execution
18. Facebook faces legal actions after data breach
19. Norton by Symantec Urges Consumers to Help Protect Their Personal Data
20. DanaBot Observed in Large Campaign Targeting U.S. Organizations

DENIAL-OF-SERVICE

21. Torii Botnet - Definitely Not a Mirai Wannabe
22. Instagram Used as Marketplace to Sell Stolen Fortnite Accounts and Botnets
23. Hacked Fortnite accounts and rent-a-botnet being pushed on Instagram
24. Hackers Use Instagram For Selling Stolen ‘Fortnite’ Accounts And Botnets
25. Enormous botnet used to hijack traffic destined for Brazilian banks
26. BYOB – Build Your Own Botnet
27. The @activereach guide to #DDoS, is aimed at technically aware business people who do not necessarily have a background in

MALVERTISING

Nothing to report

PHISHING

28. Phishing 101: Protection for Everyone
29. How to use the Firefox Master Password
30. Phishing gets more complex as decoy PDF pops up with Microsoft-issued SSL certificate
31. LastPass study shines new light on global password security practices
32. Do you know the top myths and facts of #mobile #phishing? If not, don't worry, we've compiled a list of
33. Phishing Attack Impersonates Law Firm
34. Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft
35. Phishing Attack Impersonates Law Firm
36. Password-sharing is still prevalent in the workplace – although 45 percent of businesses do now use multifactor authentication:
37. GhostDNS hijacked 100,000 router traffic directed to phishing sites
38. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
39. An extremely high number of keylogger #phishing campaigns have been seen tied to the Zoho online office suite software:
40. What is the future of authentication? Hint: It’s not passwords, passphrases or MFA
41. 100,000 routers hijacked by GhostDNS, traffic directed to phishing sites

WEB DEFACEMENT

42. Hacker Faces Jail Time After Defacing West Point, NYC Sites
43. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
44. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
45. Hacker faces jail time after defacing US military academy, NYC sites

MALWARE

46. Windows 10 October 2018 Update refines ransomware protection
47. Virus Bulletin 2018: macOS Flaw Allows Attackers to Hijack Installed Apps
48. Virus Bulletin 2018: Microsoft’s Lambert on How Cloud is Changing Security
49. Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain
50. Betabot - An Example of Cheap Modern Malware Sophistication
51. Instagram accounts frozen with ransomware | Avast
52. Instagram accounts frozen with ransomware | Avast
53. Did you know that 1 in 131 emails contains malware? In honor of #NCSAM, secure your spot for #RiskSec, expand
54. New KONNI Malware Attacking Eurasia and Southeast Asia
55. Google Taking New Steps To Prevent Malicious Chrome Extensions
56. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
57. Network Outage at Some Recipe Unlimited Locations Caused by Malware
58. Labeless Part 6: How to Resolve Obfuscated API Calls in the Ngioweb Proxy Malware
59. Banking trojans, not #ransomware, are the biggest threat to the enterprise now.
60. Labeless Part 5: How to Decrypt Strings in Boleto Banking Malware Without Reconstructing Decryption Algorithm.
61. Cisco Talos spotted 18 vulnerabilities in Foxit PDF Reader, 8 in Atlantis World Processor
62. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
63. New Danabot Banking Malware campaign now targets banks in the U.S.
64. Zoho domains central to keylogger, data theft campaigns worldwide
65. Recipe Unlimited denies ransomware attack, despite alleged ransom note
66. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
67. IDG Contributor Network: Will your company be valued by its price-to-data ratio?
68. Researchers from @alienvault found a new #cryptocurrency mining malware -- dubbed #MassMiner -- that infects systems across the web. Learn
69. Introducing... THE HUNT: A Cyber Attack in the Process Industry
70. Researchers associated the recently discovered NOKKI Malware to North Korean APT
71. Changes to #Sanny #malware delivery method attacks were recently discovered by @FireEye researches. Learn who is at risk and how
72. Ransomware Hits Port of San Diego
73. An extremely high number of keylogger #phishing campaigns have been seen tied to the Zoho online office suite software:
74. Z-LAB Report – Analyzing the GandCrab v5 ransomware
75. Preventing and Detecting Malicious Insiders
76. In 1999, AV-TEST reported that there were 98,428 total unique malware samples. Today, AV-TEST registers over 350,000 new pieces of
77. Cheap Android Phones and Poor Quality Control Leads to Malware Surprise
78. DanaBot Observed in Large Campaign Targeting U.S. Organizations

EXPLOIT

79. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
80. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
81. Heipparallaa! Uudessa jaksossamme sivuutamme ajankohtaiset aiheet ja keskitymme puhumaan @japi999 ja @ekoivune kanssa tietoturva-asiantuntijuudesta. Bonusvieraana tällä kertaa OpSecin sijaan @Larppa1337!

VULNERABILITY

82. Virus Bulletin 2018: macOS Flaw Allows Attackers to Hijack Installed Apps
83. [SingCERT] Alert on 47 Critical Vulnerabilities in Adobe Acrobat and Adobe Reader
84. Mozilla Firefox Releases 62.0.3 & Security Updates for 2 High Critical Vulnerabilities
85. Women in Information Security: Pam Armstrong
86. Vulnerability Spotlight: Google PDFium JBIG2 Image ComposeToOpt2WithRect Information Disclosure Vulnerability
87. Foxit patches 118 vulnerabilities in popular PDF reader
88. Experts found 9 NAS flaws that expose LenovoEMC, Iomega Devices to hack
89. The one serious MacBook Pro security flaw that nobody is talking about
90. Update now: Adobe fixes 85 serious flaws in Acrobat and Reader
91. 18 Vulnerabilities Found in Foxit PDF Reader
92. 18 Vulnerabilities Found in Foxit PDF Reader
93. Marine Corps bug bounty program finds 150 vulnerabilities
94. TP-Link router vulnerable to remote takeover flaw
95. Cisco Talos spotted 18 vulnerabilities in Foxit PDF Reader, 8 in Atlantis World Processor
96. Adobe update cleans up 86 bugs in Acrobat and Reader, many critical
97. Facebook Reveals That Trio of Bugs Led to Data Breach
98. TP-Link router vulnerable to remote takeover flaw
99. Adobe update cleans up 86 bugs in Acrobat and Reader, many critical
100. The Intel Management Engine exposes a new vulnerability
101. How an improper #authentication flaw affects
102. Vulnerability Spotlight: Google PDFium JBIG2 Image ComposeToOpt2WithRect Information Disclosure Vulnerability
103. CyberSecurity Asean security alert on A Vulnerability in Microsoft Windows JET Database Engine Could Allow for Remote Code Execution
104. Vulnerabilities expose Iomega and LenovoEMC NAS devices to attacks
105. Estonia sues Gemalto for €152M for the flaws in the identification cards issued by the company
106. Scanning for OWASP Top 10 Vulnerabilities with Metasploit for the Web(w3af)
107. Mozilla Firefox 62.0.3 releases: Fixed hangs on macOS Mojave & security bugs
108. Apple iOS 12 Texting Bug Sends Messages To Wrong Contacts

Region brief for 2018-10-03

ASIA

1. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
2. FakeSpy Is Back as Part of New SmiShing Campaign, Adds New Features
3. DHS aware of ongoing APT attacks on cloud service providers
4. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
5. FireEye unmasks a new North Korean threat group
6. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
7. APT38: Details on New North Korean Regime-Backed Threat Group
8. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
9. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
10. Zoho domains central to keylogger, data theft campaigns worldwide
11. GhostDNS hijacked 100,000 router traffic directed to phishing sites
12. Researchers associated the recently discovered NOKKI Malware to North Korean APT
13. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
14. North Korean HIDDEN COBRA Hackers Using New Attack Called “FASTCash” to Cash-out From ATM Machine
15. Enormous botnet used to hijack traffic destined for Brazilian banks

OCEANIA

16. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
17. New Danabot Banking Malware campaign now targets banks in the U.S.

NORTH AMERICA

18. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
19. Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain
20. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
21. FireEye unmasks a new North Korean threat group
22. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
23. APT38: Details on New North Korean Regime-Backed Threat Group
24. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
25. #DanaBot Observed in Large Campaign Targeting U.S. Organizations
26. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
27. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
28. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
29. New Danabot Banking Malware campaign now targets banks in the U.S.
30. Hacker faces jail time after defacing US military academy, NYC sites
31. GhostDNS hijacked 100,000 router traffic directed to phishing sites
32. See clearly, decide wisely with visibility and management
33. Researchers associated the recently discovered NOKKI Malware to North Korean APT
34. Ransomware Hits Port of San Diego
35. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
36. Vulnerabilities expose Iomega and LenovoEMC NAS devices to attacks
37. Facebook faces legal actions after data breach
38. 100,000 routers hijacked by GhostDNS, traffic directed to phishing sites
39. DanaBot Observed in Large Campaign Targeting U.S. Organizations

SOUTH AMERICA

40. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
41. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
42. GhostDNS hijacked 100,000 router traffic directed to phishing sites
43. Enormous botnet used to hijack traffic destined for Brazilian banks

EUROPE

44. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
45. New Danabot Banking Malware campaign now targets banks in the U.S.
46. The Intel Management Engine exposes a new vulnerability
47. Researchers associated the recently discovered NOKKI Malware to North Korean APT
48. Z-LAB Report – Analyzing the GandCrab v5 ransomware
49. Estonia sues Gemalto for €152M for the flaws in the identification cards issued by the company

AFRICA

Nothing to report

Sector brief for 2018-10-03

HEALTHCARE

1. Women in Information Security: Pam Armstrong
2. Gwinnett Medical Center Investigates Possible Data Breach
3. Gwinnett Medical Center investigates possible data breach
4. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
5. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific

TRANSPORT

6. Ransomware Hits Port of San Diego

BANKING & FINANCE

7. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
8. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
9. FireEye unmasks a new North Korean threat group
10. APT38: Details on New North Korean Regime-Backed Threat Group
11. Banking trojans, not #ransomware, are the biggest threat to the enterprise now.
12. Labeless Part 5: How to Decrypt Strings in Boleto Banking Malware Without Reconstructing Decryption Algorithm.
13. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
14. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
15. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
16. New Danabot Banking Malware campaign now targets banks in the U.S.
17. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
18. GhostDNS hijacked 100,000 router traffic directed to phishing sites
19. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
20. IDG Contributor Network: Will your company be valued by its price-to-data ratio?
21. Z-LAB Report – Analyzing the GandCrab v5 ransomware
22. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
23. North Korean HIDDEN COBRA Hackers Using New Attack Called “FASTCash” to Cash-out From ATM Machine
24. New Betabot campaign under the microscope
25. Enormous botnet used to hijack traffic destined for Brazilian banks
26. BYOB – Build Your Own Botnet
27. What is the future of authentication? Hint: It’s not passwords, passphrases or MFA
28. Norton by Symantec Urges Consumers to Help Protect Their Personal Data
29. DanaBot Observed in Large Campaign Targeting U.S. Organizations

INFORMATION & TELECOMMUNICATION

30. Virus Bulletin 2018: Microsoft’s Lambert on How Cloud is Changing Security
31. The ultimate fallout from the Facebook data breach could be massive
32. Phishing gets more complex as decoy PDF pops up with Microsoft-issued SSL certificate
33. Instagram accounts frozen with ransomware | Avast
34. Instagram accounts frozen with ransomware | Avast
35. Vulnerability Spotlight: Google PDFium JBIG2 Image ComposeToOpt2WithRect Information Disclosure Vulnerability
36. Do you know the top myths and facts of #mobile #phishing? If not, don't worry, we've compiled a list of
37. Google Taking New Steps To Prevent Malicious Chrome Extensions
38. Instagram Used as Marketplace to Sell Stolen Fortnite Accounts and Botnets
39. 18 Vulnerabilities Found in Foxit PDF Reader
40. Phishing Attack Impersonates Law Firm
41. Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft
42. Hacked Fortnite accounts and rent-a-botnet being pushed on Instagram
43. 18 Vulnerabilities Found in Foxit PDF Reader
44. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
45. Phishing Attack Impersonates Law Firm
46. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
47. Facebook Reveals That Trio of Bugs Led to Data Breach
48. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
49. New Danabot Banking Malware campaign now targets banks in the U.S.
50. GhostDNS hijacked 100,000 router traffic directed to phishing sites
51. Recipe Unlimited denies ransomware attack, despite alleged ransom note
52. IDG Contributor Network: Will your company be valued by its price-to-data ratio?
53. Introducing... THE HUNT: A Cyber Attack in the Process Industry
54. Vulnerability Spotlight: Google PDFium JBIG2 Image ComposeToOpt2WithRect Information Disclosure Vulnerability
55. Researchers associated the recently discovered NOKKI Malware to North Korean APT
56. .@Lookout’s @VijayaKaza is at @FedNewsRadio’s studio recording with @gschumm!
57. Hackers Use Instagram For Selling Stolen ‘Fortnite’ Accounts And Botnets
58. CyberSecurity Asean security alert on A Vulnerability in Microsoft Windows JET Database Engine Could Allow for Remote Code Execution
59. Preventing and Detecting Malicious Insiders
60. Facebook faces legal actions after data breach
61. Enormous botnet used to hijack traffic destined for Brazilian banks
62. The @activereach guide to #DDoS, is aimed at technically aware business people who do not necessarily have a background in
63. Norton by Symantec Urges Consumers to Help Protect Their Personal Data
64. In 1999, AV-TEST reported that there were 98,428 total unique malware samples. Today, AV-TEST registers over 350,000 new pieces of
65. Heipparallaa! Uudessa jaksossamme sivuutamme ajankohtaiset aiheet ja keskitymme puhumaan @japi999 ja @ekoivune kanssa tietoturva-asiantuntijuudesta. Bonusvieraana tällä kertaa OpSecin sijaan @Larppa1337!

FOOD

Nothing to report

WATER

Nothing to report

ENERGY

66. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
67. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks

GOVERNMENT & PUBLIC SERVICE

Nothing to report

Daily brief for 2018-10-03

ASIA

1. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
2. FakeSpy Is Back as Part of New SmiShing Campaign, Adds New Features
3. DHS aware of ongoing APT attacks on cloud service providers
4. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
5. FireEye unmasks a new North Korean threat group
6. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
7. APT38: Details on New North Korean Regime-Backed Threat Group
8. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
9. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
10. Zoho domains central to keylogger, data theft campaigns worldwide
11. GhostDNS hijacked 100,000 router traffic directed to phishing sites
12. Researchers associated the recently discovered NOKKI Malware to North Korean APT
13. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
14. North Korean HIDDEN COBRA Hackers Using New Attack Called “FASTCash” to Cash-out From ATM Machine
15. Enormous botnet used to hijack traffic destined for Brazilian banks

WORLD

16. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
17. Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain
18. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
19. FireEye unmasks a new North Korean threat group
20. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
21. APT38: Details on New North Korean Regime-Backed Threat Group
22. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
23. #DanaBot Observed in Large Campaign Targeting U.S. Organizations
24. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
25. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
26. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
27. New Danabot Banking Malware campaign now targets banks in the U.S.
28. Hacker faces jail time after defacing US military academy, NYC sites
29. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
30. GhostDNS hijacked 100,000 router traffic directed to phishing sites
31. The Intel Management Engine exposes a new vulnerability
32. See clearly, decide wisely with visibility and management
33. Researchers associated the recently discovered NOKKI Malware to North Korean APT
34. Ransomware Hits Port of San Diego
35. Z-LAB Report – Analyzing the GandCrab v5 ransomware
36. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
37. Vulnerabilities expose Iomega and LenovoEMC NAS devices to attacks
38. Facebook faces legal actions after data breach
39. Estonia sues Gemalto for €152M for the flaws in the identification cards issued by the company
40. Enormous botnet used to hijack traffic destined for Brazilian banks
41. 100,000 routers hijacked by GhostDNS, traffic directed to phishing sites
42. DanaBot Observed in Large Campaign Targeting U.S. Organizations

ATTACKS

43. Phishing 101: Protection for Everyone
44. FakeSpy Is Back as Part of New SmiShing Campaign, Adds New Features
45. How to use the Firefox Master Password
46. The ultimate fallout from the Facebook data breach could be massive
47. Phishing gets more complex as decoy PDF pops up with Microsoft-issued SSL certificate
48. LastPass study shines new light on global password security practices
49. Do you know the top myths and facts of #mobile #phishing? If not, don't worry, we've compiled a list of
50. Hacker Faces Jail Time After Defacing West Point, NYC Sites
51. Gwinnett Medical Center Investigates Possible Data Breach
52. Torii Botnet - Definitely Not a Mirai Wannabe
53. Instagram Used as Marketplace to Sell Stolen Fortnite Accounts and Botnets
54. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
55. Phishing Attack Impersonates Law Firm
56. Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft
57. Hacked Fortnite accounts and rent-a-botnet being pushed on Instagram
58. Gwinnett Medical Center investigates possible data breach
59. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
60. GhostDNS hijacking campaign steps up attacks on Brazilians; 100K+ devices compromised
61. Phishing Attack Impersonates Law Firm
62. #DanaBot Observed in Large Campaign Targeting U.S. Organizations
63. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
64. Facebook Reveals That Trio of Bugs Led to Data Breach
65. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
66. New Danabot Banking Malware campaign now targets banks in the U.S.
67. Hacker faces jail time after defacing US military academy, NYC sites
68. Zoho domains central to keylogger, data theft campaigns worldwide
69. Password-sharing is still prevalent in the workplace – although 45 percent of businesses do now use multifactor authentication:
70. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
71. GhostDNS hijacked 100,000 router traffic directed to phishing sites
72. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
73. .@Lookout’s @VijayaKaza is at @FedNewsRadio’s studio recording with @gschumm!
74. How Ashley Madison Recovered From Its Massive Data Breach
75. Hackers Use Instagram For Selling Stolen ‘Fortnite’ Accounts And Botnets
76. An extremely high number of keylogger #phishing campaigns have been seen tied to the Zoho online office suite software:
77. New Betabot campaign under the microscope
78. CyberSecurity Asean security alert on A Vulnerability in Microsoft Windows JET Database Engine Could Allow for Remote Code Execution
79. Facebook faces legal actions after data breach
80. Enormous botnet used to hijack traffic destined for Brazilian banks
81. BYOB – Build Your Own Botnet
82. The @activereach guide to #DDoS, is aimed at technically aware business people who do not necessarily have a background in
83. What is the future of authentication? Hint: It’s not passwords, passphrases or MFA
84. Norton by Symantec Urges Consumers to Help Protect Their Personal Data
85. 100,000 routers hijacked by GhostDNS, traffic directed to phishing sites
86. DanaBot Observed in Large Campaign Targeting U.S. Organizations

THREATS

87. Windows 10 October 2018 Update refines ransomware protection
88. Virus Bulletin 2018: macOS Flaw Allows Attackers to Hijack Installed Apps
89. Virus Bulletin 2018: Microsoft’s Lambert on How Cloud is Changing Security
90. [SingCERT] Alert on 47 Critical Vulnerabilities in Adobe Acrobat and Adobe Reader
91. Malware Outbreak Causes Disruptions, Closures at Canadian Restaurant Chain
92. Mozilla Firefox Releases 62.0.3 & Security Updates for 2 High Critical Vulnerabilities
93. Betabot - An Example of Cheap Modern Malware Sophistication
94. Instagram accounts frozen with ransomware | Avast
95. Instagram accounts frozen with ransomware | Avast
96. Did you know that 1 in 131 emails contains malware? In honor of #NCSAM, secure your spot for #RiskSec, expand
97. Women in Information Security: Pam Armstrong
98. Vulnerability Spotlight: Google PDFium JBIG2 Image ComposeToOpt2WithRect Information Disclosure Vulnerability
99. New KONNI Malware Attacking Eurasia and Southeast Asia
100. Google Taking New Steps To Prevent Malicious Chrome Extensions
101. Foxit patches 118 vulnerabilities in popular PDF reader
102. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
103. Experts found 9 NAS flaws that expose LenovoEMC, Iomega Devices to hack
104. Network Outage at Some Recipe Unlimited Locations Caused by Malware
105. The one serious MacBook Pro security flaw that nobody is talking about
106. Update now: Adobe fixes 85 serious flaws in Acrobat and Reader
107. Labeless Part 6: How to Resolve Obfuscated API Calls in the Ngioweb Proxy Malware
108. 18 Vulnerabilities Found in Foxit PDF Reader
109. Banking trojans, not #ransomware, are the biggest threat to the enterprise now.
110. Labeless Part 5: How to Decrypt Strings in Boleto Banking Malware Without Reconstructing Decryption Algorithm.
111. 18 Vulnerabilities Found in Foxit PDF Reader
112. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
113. Marine Corps bug bounty program finds 150 vulnerabilities
114. TP-Link router vulnerable to remote takeover flaw
115. Cisco Talos spotted 18 vulnerabilities in Foxit PDF Reader, 8 in Atlantis World Processor
116. Adobe update cleans up 86 bugs in Acrobat and Reader, many critical
117. Ransomware operators breach 40.000+ records from Fetal Diagnostic Institute of the Pacific
118. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
119. Facebook Reveals That Trio of Bugs Led to Data Breach
120. TP-Link router vulnerable to remote takeover flaw
121. Adobe update cleans up 86 bugs in Acrobat and Reader, many critical
122. New Danabot Banking Malware campaign now targets banks in the U.S.
123. Zoho domains central to keylogger, data theft campaigns worldwide
124. Recipe Unlimited denies ransomware attack, despite alleged ransom note
125. The Intel Management Engine exposes a new vulnerability
126. How an improper #authentication flaw affects
127. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
128. IDG Contributor Network: Will your company be valued by its price-to-data ratio?
129. Researchers from @alienvault found a new #cryptocurrency mining malware -- dubbed #MassMiner -- that infects systems across the web. Learn
130. Introducing... THE HUNT: A Cyber Attack in the Process Industry
131. Vulnerability Spotlight: Google PDFium JBIG2 Image ComposeToOpt2WithRect Information Disclosure Vulnerability
132. Researchers associated the recently discovered NOKKI Malware to North Korean APT
133. Changes to #Sanny #malware delivery method attacks were recently discovered by @FireEye researches. Learn who is at risk and how
134. Ransomware Hits Port of San Diego
135. An extremely high number of keylogger #phishing campaigns have been seen tied to the Zoho online office suite software:
136. Z-LAB Report – Analyzing the GandCrab v5 ransomware
137. CyberSecurity Asean security alert on A Vulnerability in Microsoft Windows JET Database Engine Could Allow for Remote Code Execution
138. Preventing and Detecting Malicious Insiders
139. Vulnerabilities expose Iomega and LenovoEMC NAS devices to attacks
140. Estonia sues Gemalto for €152M for the flaws in the identification cards issued by the company
141. Scanning for OWASP Top 10 Vulnerabilities with Metasploit for the Web(w3af)
142. Mozilla Firefox 62.0.3 releases: Fixed hangs on macOS Mojave & security bugs
143. In 1999, AV-TEST reported that there were 98,428 total unique malware samples. Today, AV-TEST registers over 350,000 new pieces of
144. Apple iOS 12 Texting Bug Sends Messages To Wrong Contacts
145. Heipparallaa! Uudessa jaksossamme sivuutamme ajankohtaiset aiheet ja keskitymme puhumaan @japi999 ja @ekoivune kanssa tietoturva-asiantuntijuudesta. Bonusvieraana tällä kertaa OpSecin sijaan @Larppa1337!
146. Cheap Android Phones and Poor Quality Control Leads to Malware Surprise
147. DanaBot Observed in Large Campaign Targeting U.S. Organizations

CRIME

148. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
149. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
150. FireEye unmasks a new North Korean threat group
151. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
152. APT38: Details on New North Korean Regime-Backed Threat Group
153. Banking trojans, not #ransomware, are the biggest threat to the enterprise now.
154. Labeless Part 5: How to Decrypt Strings in Boleto Banking Malware Without Reconstructing Decryption Algorithm.
155. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
156. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
157. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
158. Vietnam-Born Worker in U.S Intelligence Ordered Prison over Data Theft and Leakage
159. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks
160. New Danabot Banking Malware campaign now targets banks in the U.S.
161. Zoho domains central to keylogger, data theft campaigns worldwide
162. 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
163. GhostDNS hijacked 100,000 router traffic directed to phishing sites
164. Recipe Unlimited denies ransomware attack, despite alleged ransom note
165. Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data
166. Ransomware Hits Port of San Diego
167. Z-LAB Report – Analyzing the GandCrab v5 ransomware
168. Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash
169. North Korean HIDDEN COBRA Hackers Using New Attack Called “FASTCash” to Cash-out From ATM Machine
170. New Betabot campaign under the microscope
171. Facebook faces legal actions after data breach
172. Estonia sues Gemalto for €152M for the flaws in the identification cards issued by the company
173. Enormous botnet used to hijack traffic destined for Brazilian banks
174. BYOB – Build Your Own Botnet
175. What is the future of authentication? Hint: It’s not passwords, passphrases or MFA
176. DanaBot Observed in Large Campaign Targeting U.S. Organizations

POLITICS

177. Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide
178. DHS aware of ongoing APT attacks on cloud service providers
179. 3 types of attacks with ransomware: Cyber-theft, extortion, and sabotage
180. FireEye unmasks a new North Korean threat group
181. Hacker Defacing 11,000 US Websites Faces 10 Years behind Bars
182. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers
183. Hacktivist pleads guilty to defacing websites for NYC comptroller, Combating Terrorism Center
184. TA18-276A: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
185. Weekly Threat Briefing: Cobalt Threat Group Serves Up SpicyOmelette Fresh Bank Attacks