Daily brief for 2018-10-10

ASIA

1. KeyBoy Abuses Popular Office Exploits for Malware Delivery
2. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
3. Thieves and Geeks: Russian and Chinese Hacking Communities
4. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
5. MuddyWater expands operations
6. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
7. Leak reveals Google's Chinese search engine is months away from launch

WORLD

8. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
9. Campaign 2018: These hacking groups could target the 2018 midterm elections
10. Top 5 ThreatConnect Resources for Malware Analysis
11. Cyber Fraud Ring Used Phishing to Steal $4 Million, Alleged Leader Faces Charges
12. A Google security audit uncovered a glitch in Google+ that exposed data from nearly 500,000 accounts. Ping CTO West @baber
13. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
14. Thieves and Geeks: Russian and Chinese Hacking Communities
15. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
16. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
17. Rebound Orthopedics & Neurosurgery hacked; 2,800 records exposed
18. A @Google #SecurityAudit uncovered privacy flaws and potential exposure of #PersonalData, leading to API changes, the shutdown of #GooglePlus and
19. Security Vulnerabilities in US Weapons Systems
20. Don't make us pay compensation for employee data breach, Morrisons begs UK court
21. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
22. MuddyWater expands operations
23. Ubisoft Hit With DDoS Attack During The Launch of Assassin’s Creed: Odyssey
24. Magecart Hits Popular Customer Review Plugin
25. A #Google security audit uncovered a glitch in #GooglePlus that exposed data from nearly 500,000 accounts, causing the company to
26. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
27. '5,000 UK firms' financial details exposed in data breaches' http://www.cityam.com/264491/uk-business-emails-could-represent-major-cyber-security … @CityAM Read the full research report here:
28. Zero-day exploit (CVE-2018-8453) used in targeted attacks
29. My Health Record justifications 'kind of lame': Godwin
30. Shopper Approved, the new victim of the Magecart hacking group
31. Acorus Network protects enterprises and service providers from DDoS attacks

ATTACKS

32. Campaign 2018: These hacking groups could target the 2018 midterm elections
33. 4.5 Billion Records Stolen in Data Breaches in the First Six Months of 2018
34. “You have 48 hours after reading this letter”– How to Identify the Latest Phishing Scam
35. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
36. Google Restricts Android Apps From Accessing Your Personal Data
37. Triangulating Beyond the Hack: Stolen Records Just One Tool in a Comprehensive Kit
38. Cyber Fraud Ring Used Phishing to Steal $4 Million, Alleged Leader Faces Charges
39. #NetSpectre exploits leak data remotely via side-channel attacks. Learn how to use #ThreatModeling to stop speculative execution from expert Ed
40. A Google security audit uncovered a glitch in Google+ that exposed data from nearly 500,000 accounts. Ping CTO West @baber
41. Innovative Phishing Tactic Makes Inroads Using Azure Blob
42. Razer Phone 2 leaks hours before announcement: wireless charging and IP67 water resistance
43. Goodbye Google Plus – Google Plans Google+ Shut Down After Data Breach
44. The #TLBleed vulnerability uses @Intel's HTT chip feature to leak data. Learn about how hackers could use #malware to launch
45. New state-backed espionage campaign targets military and government using freely available hacking tools
46. Follow @PhishingAi to stay up to date on #phishing attacks and trends!
47. Flaw in Ghostscript sandbox allowed system compromise
48. Emerging threat: password stuffing explained
49. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
50. Leaks suggest Samsung is working on a mid-range smartphone with four cameras
51. Rebound Orthopedics & Neurosurgery hacked; 2,800 records exposed
52. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials are openly
53. The spearphishing email contained a zip folder with a custom-built remote access trojan (RAT). Once executed, it would connect back to
54. Hackers can compromise your WhatsApp account by tricking you into answering a video call
55. Google+ API glitch exposed user profile data to developers
56. 291 records breached per second in first half of 2018
57. Hackers can use legitimate #AdminTools to compromise networks. Learn more about "living off the land" attacks from expert Michael Cobb
58. Don't make us pay compensation for employee data breach, Morrisons begs UK court
59. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
60. A $12 million case of business email compromise.
61. Microsoft WindowsCodecs.dll SniffAndConvertToWideString Information Leak Vulnerability
62. A #Google security audit uncovered a glitch in #GooglePlus that exposed data from nearly 500,000 accounts, causing the company to
63. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan
64. '5,000 UK firms' financial details exposed in data breaches' http://www.cityam.com/264491/uk-business-emails-could-represent-major-cyber-security … @CityAM Read the full research report here:
65. New Phishing Campaign Drops Ursnif into Conversation Threads
66. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
67. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
68. Leak reveals Google's Chinese search engine is months away from launch
69. PHASE 2 - INITIAL INTRUSION Number One decides it is time to launch a targeted spearphishing campaign. Through the newsletter, he learns
70. My Health Record justifications 'kind of lame': Godwin
71. Just Answering A Video Call Could Compromise Your WhatsApp Account
72. Acorus Network protects enterprises and service providers from DDoS attacks
73. Zero trust security: 5 reasons it’s not just about passwords
74. .@Google Firebase #DatabaseSecurity proved insufficient when bypassed by hackers to leak data. Learn more about this #SecurityFlaw from expert Michael

THREATS

75. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
76. Decrypting GandCrab Ransomware
77. CCSP Domain 4: Cloud Application Security
78. CCSP Domain 3: Cloud Platform and Infrastructure Security
79. FruityArmor APT Exploits Yet Another Windows Graphics Kernel Flaw
80. CCSP Domain 2: Cloud Data Security
81. CCSP Domain 1: Architectural Concepts & Design Requirements
82. The CAP Exam: Application Process, Rules and Eligibility, Exam Length and More
83. #ISC2Congress: The Promise of Blockchain
84. Top 5 ThreatConnect Resources for Malware Analysis
85. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
86. WhatsApp Fixes Vulnerability That’s Triggered by Answering a Call.
87. Cryptomining replaces ransomware as 2018's top cybersecurity threat
88. WhatsApp fixes video call bug that could have let hackers in, says report
89. KeyBoy Abuses Popular Office Exploits for Malware Delivery
90. Microsoft Added Severity Levels to Feedback Hub Bug Reports for Windows 10
91. Vulnerabilities found in Intel Unified Shader compiler
92. Malware 101: How Malware Avoids Static Detection Techniques
93. The #TLBleed vulnerability uses @Intel's HTT chip feature to leak data. Learn about how hackers could use #malware to launch
94. CSEU 2018: Nato grappling with implications of cyberspace as domain of warfare
95. Flaw in Ghostscript sandbox allowed system compromise
96. Four Critical Flaws Patched in Adobe Digital Edition
97. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
98. SAP Patches Critical Vulnerability in BusinessObjects
99. Symantec reveals state-sponsored group that doesn’t care for malware
100. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
101. Stegware: How is #malware using #steganography techniques to avoid detection?
102. A @Google #SecurityAudit uncovered privacy flaws and potential exposure of #PersonalData, leading to API changes, the shutdown of #GooglePlus and
103. The spearphishing email contained a zip folder with a custom-built remote access trojan (RAT). Once executed, it would connect back to
104. #Shodan can be a helpful tool for security professionals to locate #ICSsecurity vulnerabilities. Expert Ernie Hayden explains how Shodan works
105. Security Vulnerabilities in US Weapons Systems
106. Microsoft Patch Tuesday update covers zero-day, 12 critical issues
107. Many Siemens Products Affected by Foreshadow Vulnerabilities
108. A remote access #Trojan -- dubbed #GravityRAT -- was discovered by Cisco Talos (@TalosSecurity) to be checking for #antimalware sandboxes.
109. Microsoft has fixed the Windows 10 October Update data deletion bug
110. Gallmaker: New Attack Group Eschews Malware to Live off the Land
111. It's October 2018, and Exchange can be pwned by an 8 year-old... bug
112. Adobe security update fixes a handful of critical bugs, ignores Flash Player
113. .@FBI, @DHSgov call on users to mitigate #RemoteDesktop Protocol vulnerabilities and handle RDP exploits on their own, even as the
114. October 2018 Patch Tuesday: Microsoft fixes 49 flaws, one APT-wielded zero-day
115. Microsoft WindowsCodecs.dll SniffAndConvertToWideString Information Leak Vulnerability
116. Adobe October Security Update fixes 20 security flaws
117. Apple Released Security Updates for iOS 12.0.1 & iCloud with the Fixes for 21 Vulnerabilities
118. Google+ to shut down due to lack of adoption and privacy bug
119. Microsoft Fixes Zero Day and Data Deletion Bugs
120. Why Apple must be looking into using blockchain
121. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan
122. Zero-day exploit (CVE-2018-8453) used in targeted attacks
123. Windows Zero-Day Exploited in Attacks Aimed at Middle East
124. Bug bounties not a silver bullet, Katie Moussouris warns
125. Microsoft Released Security Updates & Fixed 49 Vulnerabilities that Affected Microsoft Products
126. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
127. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
128. Port of San Diego Hit by a Ransomware Attack Affecting its Computer Systems
129. Old-School Malware Tricks Still Work
130. "Creation of complex malware and organisation of multi-layered targeted attacks has shifted from financially motivated cyber-criminals to state-sponsored threat actors"
131. Hacker steals over $30k USD in cryptocurrency of SpankChain
132. WhatsApp fixes bug that let hackers take over app when answering a video call
133. At the 2018 @RSAConference, researchers discussed the rise of stegware -- #malware that uses #steganography techniques to avoid detection. Learn

CRIME

134. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
135. #ISC2Congress: The Promise of Blockchain
136. 4.5 Billion Records Stolen in Data Breaches in the First Six Months of 2018
137. “You have 48 hours after reading this letter”– How to Identify the Latest Phishing Scam
138. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
139. Triangulating Beyond the Hack: Stolen Records Just One Tool in a Comprehensive Kit
140. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
141. Thieves and Geeks: Russian and Chinese Hacking Communities
142. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
143. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials are openly
144. Payment-card-skimming Magecart strikes again: Zero out of five for infecting e-retail sites
145. Don't make us pay compensation for employee data breach, Morrisons begs UK court
146. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
147. A $12 million case of business email compromise.
148. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
149. Old-School Malware Tricks Still Work
150. "Creation of complex malware and organisation of multi-layered targeted attacks has shifted from financially motivated cyber-criminals to state-sponsored threat actors"
151. Hacker steals over $30k USD in cryptocurrency of SpankChain
152. Shopper Approved, the new victim of the Magecart hacking group
153. Acorus Network protects enterprises and service providers from DDoS attacks

POLITICS

154. Campaign 2018: These hacking groups could target the 2018 midterm elections
155. MuddyWater Threat Actor Expands Targets List
156. New state-backed espionage campaign targets military and government using freely available hacking tools
157. CSEU 2018: Nato grappling with implications of cyberspace as domain of warfare
158. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
159. Thieves and Geeks: Russian and Chinese Hacking Communities
160. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
161. Symantec reveals state-sponsored group that doesn’t care for malware
162. Hackers can compromise your WhatsApp account by tricking you into answering a video call
163. Gallmaker: New Attack Group Eschews Malware to Live off the Land
164. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
165. MuddyWater expands operations
166. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
167. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan

APT report for 2018-10-09

TRANSNATIONAL / UNKNOWN

1. Magecart Group Targets Shopper Approved in Latest Attack
2. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
3. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
4. New Magecart hack detected at Shopper Approved
5. Formjacking attacks are on the rise, with the recent #Magecart attacks the most notable examples. @Symantec has blocked almost 250,000
6. Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake

CHINA

7. DHS issued an alert on attacks aimed at Managed Service Providers

INDIA

Nil

NORTH KOREA

8. Remote robbery, an ‘IT incident’ (not a breach?), and face-off on privacy
9. Comienza en Moscú #CyberCrimeCon —el gran encuentro mundial sobre cibercrimen y ciberterrorismo— y de lo primero que hablan es de

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

10. APT28 group return to covert intelligence gathering ops in Europe and South America.

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-10-09

WINDOWS

1. Microsoft patches 0-day Windows flaw under attack
2. Microsoft Patches Windows Zero-Day Exploited by 'FruityArmor' Group
3. Microsoft October 2018 Patch Tuesday Fixes 12 Critical Vulnerabilities
4. Apple fixes iOS 12 passcode bypass vulnerabilities
5. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
6. Microsoft October Patch Tuesday Fixes 12 Critical Vulnerabilities
7. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
8. Phishing attacks use Azure Blob storage to simulate Microsoft
9. TOP 10 PHP Vulnerability Scanners

LINUX

10. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
11. New IoT botnet “hide and seek” variants target Android devices

UNIX

Nil

ANDROID

12. The end of Google+: Low usage and an API bug that exposed user data
13. New IoT botnet “hide and seek” variants target Android devices

IOS

14. Apple fixes iOS 12 passcode bypass vulnerabilities

MACOS

Nil

Threat report for 2018-10-09

DATA BREACH

1. URSNIF Phishing Campaign Spreads Malware by Replying to Existing E-mail Threads
2. Heathrow Fined For USB Stick Data Breach
3. Google+ Users, Upset Over Data Leak, Sue Google
4. Google+ will shut down after leaking info of 500k accounts
5. Amazon acknowledges that the company’s employees leaked user information to the seller
6. Upgrade Your Threat Intelligence Program Part 5: Take Down Fraud Campaigns & Cyber Scams
7. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
8. Google: We're giving you more control over what personal data apps can use
9. Garmin's Navionics exposed data belonging to thousands of customers
10. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
11. Google+ shut down after bug exposed user data
12. Over 4.5 Billion Records Breached in H1 2018, Finds Report
13. Google+ Shuts Down Following Undisclosed Data Breach
14. The end of Google+: Low usage and an API bug that exposed user data
15. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy. Read the full blog here:
16. Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake
17. Heathrow Airport fined £120,000 over USB data breach debacle
18. "Application control bypass techniques are a big thing that is happening right now - - 80% to 85% of compromises
19. For @5ean5ullivan, a security adviser at cyber firm F-Secure, a campaign’s cyber protections boil down to education — making sure
20. Google has made the decision to shut down much of its #GooglePlus social network following the disclosure of vulnerable data.
21. ​Gemalto reports 4.6 billion record breaches in the first half of 2018
22. Hackers Targeting Instagram Accounts of Influential Profiles for Ransom in a Recent Campaign
23. Sunsets for Google Plus after Reports of Data Breach
24. Google Announced Google+ Shut down, Following Security Breach That Exposed 500,000 Users Accounts
25. Oh no, looks like we can't trust our data with Google either "Google hid major Google+ security flaw that exposed
26. Cryptojacking campaign targets add-ons for popular streaming app Kodi

DENIAL-OF-SERVICE

27. New Cloud VPS Provider with Built-In DDoS Protection and Anti-Virus | SkySilk Cloud Services
28. Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs
29. New IoT botnet “hide and seek” variants target Android devices
30. Hacked #Fortnite accounts and rent-a-botnet being pushed on

MALVERTISING

Nil

PHISHING

31. How to Evade Expensive Phishing Filters with One Simple Trick
32. URSNIF Phishing Campaign Spreads Malware by Replying to Existing E-mail Threads
33. With a few keystrokes, Number One used the admin/admin login to siphon all the email addresses, names and titles of
34. As a way to inch forward in the battle of default passwords, California has passed a law that will make
35. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
36. Phishing attacks use Azure Blob storage to simulate Microsoft
37. Weak IOT passwords outlawed in California
38. California’s ban on weak default passwords isn’t going to fix IoT security
39. Police Warned that Phishing Text Messages are Used to Target the Bank Customers
40. one more reason to not use Facebook login everywhere, no matter how convenient it is.
41. Using web phishing, criminals have managed to steal $3.7 million (251 million rubles), which is 6% more than in the

WEB DEFACEMENT

Nil

MALWARE

42. Cryptomining dethrones ransomware as 2018’s top threat - Webroot
43. Slideshow: Intel from Virus Bulletin 2018
44. Block puzzle games laced with malware | Avast
45. How does #FacexWorm #malware use @Facebook Messenger to spread? Learn more about this new malware with expert @lewisnic.
46. URSNIF Phishing Campaign Spreads Malware by Replying to Existing E-mail Threads
47. The @USAgov is rolling out #2FA authentication for officers managing .gov domains, but experts say #GoogleAuthenticator might not be the
48. Panda Banker Trojan becomes part of Emotet threat distribution platform
49. New Cloud VPS Provider with Built-In DDoS Protection and Anti-Virus | SkySilk Cloud Services
50. How does #MassMiner #malware infect systems across the web?
51. Hackers breach customer rating tool used on over 7,000 websites
52. The government domain registrar -- DotGov -- began rolling out two-factor #authentication for officials managing .gov domains in order to
53. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
54. Proofpoint: One month out from deadline, half of agency domains are #DMARC compliant http://ow.ly/3SRI50iYi41 via CyberScoopNews
55. New Domains: A Wide-Open Playing Field for Cybercrime
56. #Ransomware Survival Guide: 10 things to know before, during, and after an attack:

EXPLOIT

57. Microsoft Patches Windows Zero-Day Exploited by 'FruityArmor' Group
58. Microsoft October 2018 Patch Tuesday fixes zero-day exploited by FruityArmor APT
59. Sophos recently discovered a #Samsam extortion code that performs whole-company attacks through a variety of vulnerability exploits. Discover how this
60. Active Workload Protection on Amazon EKS and AWS Fargate

VULNERABILITY

61. Microsoft patches 0-day Windows flaw under attack
62. Microsoft Patches Zero-Day Under Active Attack by APT
63. VMware Workstation, Fusion, and ESXi Affected by DoS Vulnerability, No Patch Yet
64. Microsoft Patches Windows Zero-Day Exploited by 'FruityArmor' Group
65. Microsoft October 2018 Patch Tuesday fixes zero-day exploited by FruityArmor APT
66. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
67. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
68. Vulnerability in the Intel Unified Shader compiler for the Intel Graphics Accelerator
69. Git Gets Patched for Newly Found Flaw
70. Microsoft October 2018 Patch Tuesday Fixes 12 Critical Vulnerabilities
71. Sony Bravia Smart TVs affected by a critical vulnerability
72. Apple fixes iOS 12 passcode bypass vulnerabilities
73. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
74. Microsoft October Patch Tuesday Fixes 12 Critical Vulnerabilities
75. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
76. Sophos recently discovered a #Samsam extortion code that performs whole-company attacks through a variety of vulnerability exploits. Discover how this
77. Google+ shut down after bug exposed user data
78. Vulnerability in the Intel Unified Shader compiler for the Intel Graphics Accelerator
79. Adobe Releases Security Patch Updates for 11 Vulnerabilities
80. The end of Google+: Low usage and an API bug that exposed user data
81. TOP 10 PHP Vulnerability Scanners
82. RIP Google Plus: Shutdown announced after API bug exposes 500,000 users' details
83. On our new #CyberSauna podcast: Find out how F-Secure's @nxsolle and Pasi Saarinen discovered a flaw that allows attackers to get
84. Critical vulnerability in Sony Bravia Smart TV
85. Oh no, looks like we can't trust our data with Google either "Google hid major Google+ security flaw that exposed

Region brief for 2018-10-09

ASIA

1. Panda Banker Trojan becomes part of Emotet threat distribution platform
2. DHS issued an alert on attacks aimed at Managed Service Providers
3. Police Warned that Phishing Text Messages are Used to Target the Bank Customers

OCEANIA

4. How to Evade Expensive Phishing Filters with One Simple Trick
5. ​Gemalto reports 4.6 billion record breaches in the first half of 2018

NORTH AMERICA

6. Panda Banker Trojan becomes part of Emotet threat distribution platform
7. APT28 group return to covert intelligence gathering ops in Europe and South America.
8. Sony Bravia Smart TVs affected by a critical vulnerability
9. DHS issued an alert on attacks aimed at Managed Service Providers
10. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
11. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
12. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
13. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
14. Phishing attacks use Azure Blob storage to simulate Microsoft
15. Weak IOT passwords outlawed in California
16. ​Gemalto reports 4.6 billion record breaches in the first half of 2018
17. Sunsets for Google Plus after Reports of Data Breach
18. Critical vulnerability in Sony Bravia Smart TV

SOUTH AMERICA

Nil

EUROPE

19. DHS issued an alert on attacks aimed at Managed Service Providers
20. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
21. Hackers breach customer rating tool used on over 7,000 websites
22. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
23. New Magecart hack detected at Shopper Approved
24. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads

AFRICA

Nil

Sector brief for 2018-10-09

HEALTHCARE

1. DHS issued an alert on attacks aimed at Managed Service Providers
2. Sunsets for Google Plus after Reports of Data Breach

TRANSPORT

3. Heathrow Airport fined £120,000 over USB data breach debacle

BANKING & FINANCE

4. Panda Banker Trojan becomes part of Emotet threat distribution platform
5. Amazon acknowledges that the company’s employees leaked user information to the seller
6. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
7. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
8. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
9. New Domains: A Wide-Open Playing Field for Cybercrime
10. Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake
11. Active Workload Protection on Amazon EKS and AWS Fargate
12. Police Warned that Phishing Text Messages are Used to Target the Bank Customers
13. Sunsets for Google Plus after Reports of Data Breach

INFORMATION & TELECOMMUNICATION

14. How does #FacexWorm #malware use @Facebook Messenger to spread? Learn more about this new malware with expert @lewisnic.
15. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
16. As a way to inch forward in the battle of default passwords, California has passed a law that will make
17. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
18. Formjacking attacks are on the rise, with the recent #Magecart attacks the most notable examples. @Symantec has blocked almost 250,000
19. Google+ Shuts Down Following Undisclosed Data Breach
20. Phishing attacks use Azure Blob storage to simulate Microsoft
21. The end of Google+: Low usage and an API bug that exposed user data
22. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy. Read the full blog here:
23. For @5ean5ullivan, a security adviser at cyber firm F-Secure, a campaign’s cyber protections boil down to education — making sure
24. Google has made the decision to shut down much of its #GooglePlus social network following the disclosure of vulnerable data.
25. On our new #CyberSauna podcast: Find out how F-Secure's @nxsolle and Pasi Saarinen discovered a flaw that allows attackers to get
26. Hacked #Fortnite accounts and rent-a-botnet being pushed on
27. Hackers Targeting Instagram Accounts of Influential Profiles for Ransom in a Recent Campaign
28. one more reason to not use Facebook login everywhere, no matter how convenient it is.
29. Sunsets for Google Plus after Reports of Data Breach
30. Using web phishing, criminals have managed to steal $3.7 million (251 million rubles), which is 6% more than in the
31. Comienza en Moscú #CyberCrimeCon —el gran encuentro mundial sobre cibercrimen y ciberterrorismo— y de lo primero que hablan es de
32. Oh no, looks like we can't trust our data with Google either "Google hid major Google+ security flaw that exposed
33. #Ransomware Survival Guide: 10 things to know before, during, and after an attack:

FOOD

Nil

WATER

Nil

ENERGY

34. DHS issued an alert on attacks aimed at Managed Service Providers
35. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads

GOVERNMENT & PUBLIC SERVICE

36. APT28 group return to covert intelligence gathering ops in Europe and South America.

Daily brief for 2018-10-09

ASIA

1. Panda Banker Trojan becomes part of Emotet threat distribution platform
2. DHS issued an alert on attacks aimed at Managed Service Providers
3. Police Warned that Phishing Text Messages are Used to Target the Bank Customers

WORLD

4. How to Evade Expensive Phishing Filters with One Simple Trick
5. Panda Banker Trojan becomes part of Emotet threat distribution platform
6. APT28 group return to covert intelligence gathering ops in Europe and South America.
7. Sony Bravia Smart TVs affected by a critical vulnerability
8. DHS issued an alert on attacks aimed at Managed Service Providers
9. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
10. Hackers breach customer rating tool used on over 7,000 websites
11. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
12. New Magecart hack detected at Shopper Approved
13. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
14. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
15. Phishing attacks use Azure Blob storage to simulate Microsoft
16. Weak IOT passwords outlawed in California
17. ​Gemalto reports 4.6 billion record breaches in the first half of 2018
18. Sunsets for Google Plus after Reports of Data Breach
19. Critical vulnerability in Sony Bravia Smart TV

ATTACKS

20. How to Evade Expensive Phishing Filters with One Simple Trick
21. URSNIF Phishing Campaign Spreads Malware by Replying to Existing E-mail Threads
22. Heathrow Fined For USB Stick Data Breach
23. Google+ Users, Upset Over Data Leak, Sue Google
24. New Cloud VPS Provider with Built-In DDoS Protection and Anti-Virus | SkySilk Cloud Services
25. Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs
26. Google+ will shut down after leaking info of 500k accounts
27. Amazon acknowledges that the company’s employees leaked user information to the seller
28. Upgrade Your Threat Intelligence Program Part 5: Take Down Fraud Campaigns & Cyber Scams
29. With a few keystrokes, Number One used the admin/admin login to siphon all the email addresses, names and titles of
30. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
31. Google: We're giving you more control over what personal data apps can use
32. As a way to inch forward in the battle of default passwords, California has passed a law that will make
33. Garmin's Navionics exposed data belonging to thousands of customers
34. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
35. Google+ shut down after bug exposed user data
36. Over 4.5 Billion Records Breached in H1 2018, Finds Report
37. Google+ Shuts Down Following Undisclosed Data Breach
38. Phishing attacks use Azure Blob storage to simulate Microsoft
39. The end of Google+: Low usage and an API bug that exposed user data
40. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy. Read the full blog here:
41. Weak IOT passwords outlawed in California
42. California’s ban on weak default passwords isn’t going to fix IoT security
43. Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake
44. Heathrow Airport fined £120,000 over USB data breach debacle
45. "Application control bypass techniques are a big thing that is happening right now - - 80% to 85% of compromises
46. New IoT botnet “hide and seek” variants target Android devices
47. For @5ean5ullivan, a security adviser at cyber firm F-Secure, a campaign’s cyber protections boil down to education — making sure
48. Google has made the decision to shut down much of its #GooglePlus social network following the disclosure of vulnerable data.
49. Hacked #Fortnite accounts and rent-a-botnet being pushed on
50. ​Gemalto reports 4.6 billion record breaches in the first half of 2018
51. Police Warned that Phishing Text Messages are Used to Target the Bank Customers
52. Hackers Targeting Instagram Accounts of Influential Profiles for Ransom in a Recent Campaign
53. one more reason to not use Facebook login everywhere, no matter how convenient it is.
54. Sunsets for Google Plus after Reports of Data Breach
55. Google Announced Google+ Shut down, Following Security Breach That Exposed 500,000 Users Accounts
56. Using web phishing, criminals have managed to steal $3.7 million (251 million rubles), which is 6% more than in the
57. Oh no, looks like we can't trust our data with Google either "Google hid major Google+ security flaw that exposed
58. Cryptojacking campaign targets add-ons for popular streaming app Kodi

THREATS

59. Cryptomining dethrones ransomware as 2018’s top threat - Webroot
60. Microsoft patches 0-day Windows flaw under attack
61. Microsoft Patches Zero-Day Under Active Attack by APT
62. VMware Workstation, Fusion, and ESXi Affected by DoS Vulnerability, No Patch Yet
63. Microsoft Patches Windows Zero-Day Exploited by 'FruityArmor' Group
64. Microsoft October 2018 Patch Tuesday fixes zero-day exploited by FruityArmor APT
65. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
66. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
67. Slideshow: Intel from Virus Bulletin 2018
68. Vulnerability in the Intel Unified Shader compiler for the Intel Graphics Accelerator
69. Git Gets Patched for Newly Found Flaw
70. Block puzzle games laced with malware | Avast
71. How does #FacexWorm #malware use @Facebook Messenger to spread? Learn more about this new malware with expert @lewisnic.
72. URSNIF Phishing Campaign Spreads Malware by Replying to Existing E-mail Threads
73. The @USAgov is rolling out #2FA authentication for officers managing .gov domains, but experts say #GoogleAuthenticator might not be the
74. Panda Banker Trojan becomes part of Emotet threat distribution platform
75. New Cloud VPS Provider with Built-In DDoS Protection and Anti-Virus | SkySilk Cloud Services
76. Microsoft October 2018 Patch Tuesday Fixes 12 Critical Vulnerabilities
77. Sony Bravia Smart TVs affected by a critical vulnerability
78. How does #MassMiner #malware infect systems across the web?
79. Hackers breach customer rating tool used on over 7,000 websites
80. The government domain registrar -- DotGov -- began rolling out two-factor #authentication for officials managing .gov domains in order to
81. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
82. Apple fixes iOS 12 passcode bypass vulnerabilities
83. Vulnerability Spotlight: VMWare Workstation DoS Vulnerability
84. Proofpoint: One month out from deadline, half of agency domains are #DMARC compliant http://ow.ly/3SRI50iYi41 via CyberScoopNews
85. Microsoft October Patch Tuesday Fixes 12 Critical Vulnerabilities
86. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
87. Sophos recently discovered a #Samsam extortion code that performs whole-company attacks through a variety of vulnerability exploits. Discover how this
88. Google+ shut down after bug exposed user data
89. Vulnerability in the Intel Unified Shader compiler for the Intel Graphics Accelerator
90. Adobe Releases Security Patch Updates for 11 Vulnerabilities
91. New Domains: A Wide-Open Playing Field for Cybercrime
92. The end of Google+: Low usage and an API bug that exposed user data
93. TOP 10 PHP Vulnerability Scanners
94. RIP Google Plus: Shutdown announced after API bug exposes 500,000 users' details
95. Active Workload Protection on Amazon EKS and AWS Fargate
96. On our new #CyberSauna podcast: Find out how F-Secure's @nxsolle and Pasi Saarinen discovered a flaw that allows attackers to get
97. Critical vulnerability in Sony Bravia Smart TV
98. Oh no, looks like we can't trust our data with Google either "Google hid major Google+ security flaw that exposed
99. #Ransomware Survival Guide: 10 things to know before, during, and after an attack:

CRIME

100. Cryptomining dethrones ransomware as 2018’s top threat - Webroot
101. How to Evade Expensive Phishing Filters with One Simple Trick
102. DHS issued an alert on attacks aimed at Managed Service Providers
103. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
104. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
105. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
106. Sophos recently discovered a #Samsam extortion code that performs whole-company attacks through a variety of vulnerability exploits. Discover how this
107. New Domains: A Wide-Open Playing Field for Cybercrime
108. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy. Read the full blog here:
109. Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake
110. Police Warned that Phishing Text Messages are Used to Target the Bank Customers

POLITICS

111. APT28 group return to covert intelligence gathering ops in Europe and South America.
112. DHS issued an alert on attacks aimed at Managed Service Providers

APT report for 2018-10-08

TRANSNATIONAL / UNKNOWN

1. Fin7 Cybercrime Group Hacked Burgerville and Stolen Payment Card Details

CHINA

2. Apple tells Congress it was never hacked by Chinese spy chips
3. Apple to Congress: Chinese spy-chip story is “simply wrong”
4. Bloomberg’s Chinese Hacking Report Is Wrong, Claims Apple
5. Apple denies Chinese surveillance claims, Microsoft pulls Windows 10 update video
6. UK, US Security Agencies Deny Investigating Chinese Spy Chips
7. Why I don’t believe Bloomberg’s Chinese spy chip report
8. Department of Homeland Security and GCHQ back Apple and Amazon’s denials they were hacked by China
9. Apple, Amazon deny servers affected by China microchip plot
10. China inserts microchips into motherboards used by Apple, CIA, Amazon
11. China Infiltrated Amazon, Apple, U.S. Companies Using Tiny Chip: Report
12. DHS, Apple push back on Bloomberg supply chain story
13. DHS and GCHQ Say There's no Reason to Doubt Apple, Amazon Supermicro Hack Denial
14. There’s a serious threat to the supply chain, says Pentagon
15. DHS and GCHQ join Amazon and Apple in denying Bloomberg chip hack story
16. US and UK Governments Back Denial of Supermicro Story

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

17. APT28 Gets the Spotlight, But Turla Remains Russia’s Elite Hacking Unit
18. APT28 Hacking Group’s New Espionage Operations Targets Military and Government Organizations
19. Russian Privacy Blunder May Have Outed 300 GRU Agents
20. Russia dismisses suspected spy actions as routine Dutch trip
21. Seven Russian cyberspies indicted for hacking, wire fraud, ID theft
22. Investigation Uncovers 300+ Possible GRU Officers
23. Researchers: Turla and Zebrocy APT actors shared code, targets in 2018
24. Kaspersky shed lights on the overlap of operations conducted by Turla and Sofacy
25. First In-The-Wild UEFI Rootkit Discovered

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-10-08

WINDOWS

Nil

LINUX

Nil

UNIX

Nil

ANDROID

Nil

IOS

Nil

MACOS

Nil

Threat report for 2018-10-08

DATA BREACH

1. 10/8/18: Dtex, Insider Threat, Privacy News: Dtex Earns Leadership, Product Awards; Insider Compromises French Law Enforcement Agency; The Big Hack
2. Google was aware of a flaw that exposed over 500,000 of Google Plus users, but did not disclose it
3. Google Says Social Network Bug Exposed Private Data
4. Google+ Is Shutting Down After a Security Bug Exposed User Info
5. Google chose not to go public about bug that exposed Google Plus users’ data
6. Google shuts down Google+ after API bug exposed details for over 500,000 users
7. #TLBleed exploits abuse Intel's HTT chip feature to leak data. Find out how hackers could launch side-channel attacks to obtain
8. GitLab API Vulnerability Leaked Confidential Data On Public Projects
9. Google announces plans to close Google+ for consumers following data breach
10. Google+ Shutting Down After Bug Leaks Info of 500k Accounts
11. .@David_Ingram of @NBCNews reports that political #campaigns and parties say they’re sending many more texts this year than in past
12. Google+ is Shutting Down After a Vulnerability Exposed 500,000 Users' Data
13. Expert presented a new attack technique to compromise MikroTik Routers
14. With 12,556,810 email archives already exposed across misconfigured online file stores, attackers don’t even need to perform #accounttakeovers to gain
15. ICO hits Heathrow Airport with £120,000 data breach fine over lost USB stick
16. MikroTik routers with default credentials can be easily compromised
17. Project Insecurity (@insecurity) researchers discovered certain #livechatsoftware that were leaking personal details of employee at several high-profile sites. Discover how

DENIAL-OF-SERVICE

18. Hide and Seek IoT Botnet Now Spreads to New Android Devices Using ADB over Wi-Fi
19. Assassin’s Creed Odyssey suffers DDoS attack at launch

MALVERTISING

Nil

PHISHING

20. California to Ban Weak Passwords
21. Phishing Enables Domestic Violence. Education Can Help Stop It.
22. Hook, Line and Sinker: After Phish Get Caught
23. Aspire Health Lost 'Protected Health Information' after Getting Hacked by a Phishing Scheme
24. "Life is short - passwords are long." - Finnish Communications Regulatory Authority

WEB DEFACEMENT

Nil

MALWARE

25. GRRCon Augusta 2018, Ankur Tyagi’s ‘Analyzing Multi-Dimensional Malware Dataset’
26. Malware isn't the only threat to Android apps. Others include copies of popular apps and those that abuse permission requests. Here
27. Code Execution Bug In Malicious Repositories Resolved By Git Project
28. #Stegware: it's #Malware that uses #steganography techniques to avoid detection
29. 2018's Most Active Ransomware: The Ongoing Evolution of GandCrab
30. Most hosting providers take too long to remove malware distribution sites
31. .@Trustlook Labs discovered an #Android #Trojan stealing data from messaging apps. Learn what #mobilesecurity programs should look for to detect
32. .@ThreatFabric researchers uncovered a #malware that uses overlay techniques to avoid detection. Learn from @lewisnic how this new #Androidmalware --
33. Mikko Hypponen's Picks For the Top 5 Viruses of All Time - F-Secure Blog
34. US government rolls out 2-step verification for .gov domain owners
35. Intel’s 9th-Generation Core Processors Unveiled
36. Code execution bug in malicious repositories resolved by Git Project
37. #Android #Trojan: How is data being stolen from #messagingapps?
38. #GoScanSSH: How does this #malware work and differ from others?
39. How did an organized crime group get a zip file from a reputable malware scanning service? Malware researchers occasionally have ties
40. Keeping your cloud malware-free: What you need to know
41. Virus Attack Hampers the Email System of Ulster Town
42. Beware!! Hackers Now Spreading Dangerous FlawedAmmyy Malware Through PDF & IQY File
43. First In-The-Wild UEFI Rootkit Discovered
44. The MITRE ATT&CK Framework: Command and Control
45. .@TrendMicro researchers discovered #FacexWorm, a #malware that uses a #ChromeExtension and @Facebook Messenger to spread. Learn which users are at

EXPLOIT

46. Hackers exploit vulnerability in Bitcoin code
47. #TLBleed exploits abuse Intel's HTT chip feature to leak data. Find out how hackers could launch side-channel attacks to obtain
48. Websites vulnerable to attack exploiting major framework
49. "It is no secret that the #RemoteDesktop Protocol has long been a source of exploitable vulnerabilities, and it is well
50. New Exploit for MikroTik Router WinBox Vulnerability Gives Full Root Access

VULNERABILITY

51. Google shutting down Google+ after covering up privacy bug
52. Hackers exploit vulnerability in Bitcoin code
53. Google was aware of a flaw that exposed over 500,000 of Google Plus users, but did not disclose it
54. Google Says Social Network Bug Exposed Private Data
55. WECON PI Studio HMI software affected by code execution flaws
56. Mozilla Patched Multiple Vulnerabilities In Thunderbird 60.2.1
57. Google+ Is Shutting Down After a Security Bug Exposed User Info
58. Google shuts down Google+ for consumers due to bug found months ago
59. Google chose not to go public about bug that exposed Google Plus users’ data
60. iOS 12.0.1 Released with Fixes to Passcode Bypass Bugs
61. Google+ Shutting Down After Google Discovers API Bug Affecting 500K Users
62. Google shuts down Google+ after API bug exposed details for over 500,000 users
63. Code Execution Flaws Found in WECON Industrial Products
64. GitLab API Vulnerability Leaked Confidential Data On Public Projects
65. Code Execution Bug In Malicious Repositories Resolved By Git Project
66. Google+ Shutting Down After Bug Leaks Info of 500k Accounts
67. Vulnerabilities in RouterOS could enble hackers to take control of routers
68. #Shodan, a device search engine, can help identify #ICS security vulnerabilities. Learn more about how Shodan works and how it
69. NEW #CYBERSAUNA EPISODE: Reinventing the Cold Boot Attack: Modern Laptop Version @nxsolle and Pasi Saarinen discuss how they discovered a flaw
70. Vulnerabilities discovered in electoral counting machines in 23 states
71. Most routers full of firmware flaws that leave users at risk
72. Google+ is Shutting Down After a Vulnerability Exposed 500,000 Users' Data
73. Who's watching your TV? Sony quietly killed three critical Bravia TV bugs
74. Microsoft says it can recover files lost to the Windows 10 October Update's data deletion bug
75. Tenable Researcher Reveals Extended MikroTik Router Vulnerability
76. MikroTik vulnerability climbs up the severity scale, new attack permits root access
77. Google Criticizes Apple Over Safari Security, Flaw Disclosures
78. Code execution bug in malicious repositories resolved by Git Project
79. Users complain of boot loops on Series 4 Apple Watch due to daylight savings bug
80. "It is no secret that the #RemoteDesktop Protocol has long been a source of exploitable vulnerabilities, and it is well
81. New Exploit for MikroTik Router WinBox Vulnerability Gives Full Root Access
82. The Git Project addresses a critical arbitrary code execution vulnerability in Git
83. D-Link Security Updates Fixed Multiple Vulnerabilities in WiFiManager Software
84. Beware!! Hackers Now Spreading Dangerous FlawedAmmyy Malware Through PDF & IQY File
85. PoC Attack Escalates MikroTik Router Bug to ‘As Bad As It Gets’

Region brief for 2018-10-08

ASIA

Nil

OCEANIA

Nil

NORTH AMERICA

Nil

SOUTH AMERICA

Nil

EUROPE

Nil

AFRICA

Nil