Threat report for 2018-10-24

DATA BREACH & DATA LOSS

1. Cathay Pacific breach leaks personal data on 9.4 million people
2. Cathay Pacific data breach hits 9.4 million people
3. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
4. Democratic Fundraising Firm Leaks Voter Database, Clients, Fundraisers
5. Cathay Pacific Hit by Data Leak Affecting 9.4M Passengers
6. Supermarket told it must compensate 100,000 workers after payroll data deliberately leaked by rogue employee
7. Information-Stealing Malware Campaign Evades Anti-Virus Detection
8. Cathay Pacific Suffers Data Breach Impacting 9.4 Million Passengers
9. Pocket iNet Leaves 73 GB of Sensitive Data Exposed
10. Yahoo to pay up to $85m to settle data breach lawsuit
11. Tim Cook Blasts Weaponization Of Personal Data And Praises GDPR
12. Pocket iNet Left All Of Its Corporate Passwords, Keys, And Data Exposed
13. Apple's Tim Cook: Our personal data is 'weaponized against us' by you-know-who
14. A #ZeroDay in #jQuery File Upload could affect thousands of projects because the jQuery #plugin vulnerability has existed for eight
15. Last year the @USAgov required agencies to implement #DMARC records and policies by October 2018. Learn just how hard DMARC
16. Discover how #NetSpectre attacks leak data remotely via side-channels with Michael Cobb of @thehairyITdog.
17. Yahoo Agrees to Pay $50 Million in Damages to Settle Data Breach Lawsuit
18. Business Email Compromise: Gift Cards
19. US government medical website was hacked that 75,000 personal data was stolen
20. Morrisons supermarket: We're taking payroll leak liability fight to UK Supreme Court
21. Pocket iNet ISP exposed 73GB of data including secret keys, plain text passwords
22. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
23. Yahoo agrees to pay $50 million to settle data breach lawsuit
24. My Health Record opt-outs now sit at over 1.1 million
25. ISP Provider Exposed 73 Gigabytes of Highly Sensitive Data Including To The Internet
26. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
27. Again Hacker Exposed New Microsoft Unpatched Zero-day Bug In Twitter With PoC
28. Yahoo to pay at least $85m for data breach settlement
29. Survey: Nearly Half of U.S. Adults Experienced a Data Breach in the Past Three Years
30. A recent @HealthCareGov #breach exposed unknown types of data on 75,000 people, but a lack of information in the disclosure

DENIAL-OF-SERVICE

31. This botnet snares your smart devices to perform DDoS attacks with a little help from Mirai

MALVERTISING

Nil

PHISHING

32. Phishing Attack Tip 1: Beware of Unsettling Content An email containing unsettling, startling, or urgent content that requires immediate action on
33. The Enduring Password Conundrum
34. Phishing for knowledge
35. Phishing attacks: Why is email still such an easy target for hackers?
36. Office 365 for Business - from May to September - has been Recorded Lowest Phish Miss Rate Versus Rivals
37. Area 1 Security releases Pay-Per-Phish, the performance-based cybersecurity solution

WEB DEFACEMENT

Nil

BOTNET

38. Poorly secured SSH servers targeted by Chalubo botnet
39. This botnet snares your smart devices to perform DDoS attacks with a little help from Mirai
40. "The resurgence of #VPNFilter #botnet appears to be limited to the Ukraine, but given the ease of infecting targeted systems,
41. Chalubo, a new IoT botnet emerges in the threat landscape

RANSOMWARE

42. ThreatList: Ransomware, EKs and Trojans lead the Way in Q3 Malware Trends
43. Join us, and @SentinelOne Nov 29, as we discuss fast acting #ransomware remediation, threat hunting, and #AI that stops incongruous
44. How Microsoft's Controlled Folder Access can help stop ransomware

CRYPTOMINING & CRYPTOCURRENCIES

45. ​Australian woman arrested over AU$450,000 Ripple theft
46. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
47. Meet Cryptojacking, the (not so) new kid on the block
48. FBI: Call of Duty gamers helped steal $3.3 million in cryptocurrency hacking scheme
49. Crytojacking 101; why cryptojacking is bad for business
50. China asks blockchain-based service providers to control user information
51. A Digital Currency for Everyone: 5 Easy Way Steps to Follow for Buying Bitcoin
52. Securing Blockchain with Privileged Access Management

MALWARE

53. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
54. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
55. Information-Stealing Malware Campaign Evades Anti-Virus Detection
56. New Malware Targets Industrial Control Systems
57. FlawedAmmyy Remote Access Trojan
58. Meet the malware which turns your smartphone into a mobile proxy
59. sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting
60. ThreatList: Ransomware, EKs and Trojans lead the Way in Q3 Malware Trends
61. Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware
62. Mac malware intercepts encrypted web traffic for ad injection
63. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
64. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
65. LuminosityLink RAT author sentenced to 2.5 years in jail
66. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
67. Beyond Your Bank Account: Ten Astounding Finds Uncovered by Financial Malware
68. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware

EXPLOIT

69. Exploit for New Windows Zero-Day Published on Twitter
70. Exploit kits: fall 2018 review
71. New Windows Zero-Day Bug Helps Delete Any File, Exploit Available
72. Siemens Siclock: How do threat actors exploit these devices?
73. Magecart Attackers Exploit Magento Zero-Days
74. Hacker Discloses New Windows Zero-Day Exploit On Twitter

VULNERABILITY

75. Windows ‘Deletebug’ Zero-Day Allows Privilege Escalation, Destruction
76. Vulnerabilities in Linksys Routers May Grant Attackers Full Control
77. Exploit for New Windows Zero-Day Published on Twitter
78. Cisco Patches Local WebEx Vulnerability, Remotely Exploitable in AD Deployments
79. CVE-2018-4338: Triggering an Information Disclosure on macOS Through a Broadcom AirPort Kext
80. Another Windows 0-day flaw has been published on Twitter
81. .@Siemens disclosed six SICLOCK flaws that were found within its central plant clocks. Discover why three flaws have been rated
82. SandboxEscaper expert is back and disclosed a new Windows Zero-Day
83. Pentagon Launches Continuous Bug Bounty Program
84. [SingCERT] Alert on Drupal Critical Vulnerabilities
85. A Windows 0day vulnerability was made public on Twitter
86. Organizations with strong DevSecOps find flaws 11x faster than those without
87. New Microsoft Windows Zero-Day Dropped on Twitter, Micropatch Available
88. A #ZeroDay in #jQuery File Upload could affect thousands of projects because the jQuery #plugin vulnerability has existed for eight
89. Most enterprise vulnerabilities remain unpatched a month after discovery
90. WizCase Found Critical Firmware Vulnerabilities In Leading NAS Devices
91. New Windows Zero-Day Bug Helps Delete Any File, Exploit Available
92. Twitter User Discloses Second Microsoft Zero-Day
93. Firefox 63 Released with Enhanced Tracking Protection and Fixes 14 Security Vulnerabilities
94. Most applications 'suffer from information leakage bugs'
95. DoD bug bounty program to expand to more sensitive systems
96. 3-year-old jQuery plugin vulnerability finally patched
97. US Department of Defense Expands Bug Bounty Efforts
98. The Qihoo @360CoreSec team found a @Microsoft vulnerability -- named Double Kill -- that affects applications through #MicrosoftOffice documents. Learn
99. Good initiative. Would be even better if you would pay bounties for the bugs, too.
100. Learn about the #NetSpectre vulnerability and the benefits of #ThreatModeling for cloud deployments from expert Ed Moyle of @securitycurve.
101. A summer intern took a look at tinc VPN, they found some nice authentication bypass and message tampering flaws
102. Again Hacker Exposed New Microsoft Unpatched Zero-day Bug In Twitter With PoC
103. Marine diesel engines software developed by Auto Maskin has serious vulnerabilities
104. Drupal Remote Code Execution Vulnerability Threat Alert
105. Hacker Discloses New Windows Zero-Day Exploit On Twitter

Region brief for 2018-10-24

ASIA

1. Cathay Pacific breach leaks personal data on 9.4 million people
2. Democratic Fundraising Firm Leaks Voter Database, Clients, Fundraisers
3. Cathay Pacific Hit by Data Leak Affecting 9.4M Passengers
4. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
5. Exploit kits: fall 2018 review
6. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
7. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
8. Phishing for knowledge
9. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
10. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
11. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
12. Russian Government-owned research institute linked to Triton attacks
13. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware
14. Drupal Remote Code Execution Vulnerability Threat Alert
15. China asks blockchain-based service providers to control user information

OCEANIA

16. ​Australian woman arrested over AU$450,000 Ripple theft
17. Phishing for knowledge

NORTH AMERICA

18. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
19. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
20. Meet Cryptojacking, the (not so) new kid on the block
21. Exploit kits: fall 2018 review
22. Pocket iNet Leaves 73 GB of Sensitive Data Exposed
23. Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware
24. Yahoo to pay up to $85m to settle data breach lawsuit
25. Apple's Tim Cook: Our personal data is 'weaponized against us' by you-know-who
26. US government medical website was hacked that 75,000 personal data was stolen
27. Pocket iNet ISP exposed 73GB of data including secret keys, plain text passwords
28. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
29. Phishing for knowledge
30. US Department of Defense Expands Bug Bounty Efforts
31. Join us, and @SentinelOne Nov 29, as we discuss fast acting #ransomware remediation, threat hunting, and #AI that stops incongruous
32. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
33. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
34. ISP Provider Exposed 73 Gigabytes of Highly Sensitive Data Including To The Internet
35. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
36. Survey: Nearly Half of U.S. Adults Experienced a Data Breach in the Past Three Years
37. China asks blockchain-based service providers to control user information

SOUTH AMERICA

38. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
39. Phishing for knowledge

EUROPE

40. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
41. Magecart hackers change tactic and target vulnerable Magento extensions
42. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
43. Supermarket told it must compensate 100,000 workers after payroll data deliberately leaked by rogue employee
44. New Malware Targets Industrial Control Systems
45. Yahoo to pay up to $85m to settle data breach lawsuit
46. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
47. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
48. "The resurgence of #VPNFilter #botnet appears to be limited to the Ukraine, but given the ease of infecting targeted systems,
49. Morrisons supermarket: We're taking payroll leak liability fight to UK Supreme Court
50. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
51. Phishing for knowledge
52. Magecart Attackers Exploit Magento Zero-Days
53. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
54. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
55. Russian Government-owned research institute linked to Triton attacks
56. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware
57. Marine diesel engines software developed by Auto Maskin has serious vulnerabilities

AFRICA

58. Phishing for knowledge

Sector brief for 2018-10-24

HEALTHCARE

1. US government medical website was hacked that 75,000 personal data was stolen
2. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
3. Drupal Remote Code Execution Vulnerability Threat Alert

TRANSPORT

4. CVE-2018-4338: Triggering an Information Disclosure on macOS Through a Broadcom AirPort Kext
5. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
6. Securing Blockchain with Privileged Access Management

BANKING & FINANCE

7. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
8. Magecart hackers change tactic and target vulnerable Magento extensions
9. Cathay Pacific Hit by Data Leak Affecting 9.4M Passengers
10. FlawedAmmyy Remote Access Trojan
11. Meet Cryptojacking, the (not so) new kid on the block
12. Magecart Hackers Now Targeting Vulnerable Magento Extensions
13. sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting
14. Exploit kits: fall 2018 review
15. Mac malware intercepts encrypted web traffic for ad injection
16. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
17. Phishing for knowledge
18. Magecart Attackers Exploit Magento Zero-Days
19. The risk to OT networks is real, and it’s dangerous for business leaders to ignore
20. Beyond Your Bank Account: Ten Astounding Finds Uncovered by Financial Malware
21. Russian Government-owned research institute linked to Triton attacks
22. Drupal Remote Code Execution Vulnerability Threat Alert
23. China asks blockchain-based service providers to control user information
24. A Digital Currency for Everyone: 5 Easy Way Steps to Follow for Buying Bitcoin

INFORMATION & TELECOMMUNICATION

25. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
26. Exploit for New Windows Zero-Day Published on Twitter
27. Meet Cryptojacking, the (not so) new kid on the block
28. Another Windows 0-day flaw has been published on Twitter
29. Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware
30. SandboxEscaper expert is back and disclosed a new Windows Zero-Day
31. [SingCERT] Alert on Drupal Critical Vulnerabilities
32. A Windows 0day vulnerability was made public on Twitter
33. New Microsoft Windows Zero-Day Dropped on Twitter, Micropatch Available
34. Twitter User Discloses Second Microsoft Zero-Day
35. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
36. Need help managing supply chain risks? In this week's ShadowTalk episode, the team breaks it down into hardware, software
37. Pocket iNet ISP exposed 73GB of data including secret keys, plain text passwords
38. Phishing for knowledge
39. Magecart Attackers Exploit Magento Zero-Days
40. Join us, and @SentinelOne Nov 29, as we discuss fast acting #ransomware remediation, threat hunting, and #AI that stops incongruous
41. Good initiative. Would be even better if you would pay bounties for the bugs, too.
42. ISP Provider Exposed 73 Gigabytes of Highly Sensitive Data Including To The Internet
43. Office 365 for Business - from May to September - has been Recorded Lowest Phish Miss Rate Versus Rivals
44. Again Hacker Exposed New Microsoft Unpatched Zero-day Bug In Twitter With PoC
45. China asks blockchain-based service providers to control user information
46. Hacker Discloses New Windows Zero-Day Exploit On Twitter
47. NETSCOUT Takes Internet Scale Threat Protection to the Edge

FOOD

Nil

WATER

Nil

ENERGY

48. New Malware Targets Industrial Control Systems
49. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
50. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
51. Drupal Remote Code Execution Vulnerability Threat Alert

GOVERNMENT & PUBLIC SERVICE

52. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
53. Federal Legislation Enables Consumers to Obtain Security Freezes on Credit Reports Free of Charge
54. Yahoo to pay up to $85m to settle data breach lawsuit
55. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
56. US government medical website was hacked that 75,000 personal data was stolen
57. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
58. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
59. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
60. Russian Government-owned research institute linked to Triton attacks
61. Survey: Nearly Half of U.S. Adults Experienced a Data Breach in the Past Three Years
62. China asks blockchain-based service providers to control user information

Daily brief for 2018-10-24

ASIA

1. Cathay Pacific breach leaks personal data on 9.4 million people
2. Democratic Fundraising Firm Leaks Voter Database, Clients, Fundraisers
3. Cathay Pacific Hit by Data Leak Affecting 9.4M Passengers
4. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
5. Exploit kits: fall 2018 review
6. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
7. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
8. Phishing for knowledge
9. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
10. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
11. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
12. Russian Government-owned research institute linked to Triton attacks
13. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware
14. Drupal Remote Code Execution Vulnerability Threat Alert
15. China asks blockchain-based service providers to control user information

WORLD

16. ​Australian woman arrested over AU$450,000 Ripple theft
17. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
18. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
19. Magecart hackers change tactic and target vulnerable Magento extensions
20. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
21. Supermarket told it must compensate 100,000 workers after payroll data deliberately leaked by rogue employee
22. New Malware Targets Industrial Control Systems
23. Meet Cryptojacking, the (not so) new kid on the block
24. Exploit kits: fall 2018 review
25. Pocket iNet Leaves 73 GB of Sensitive Data Exposed
26. Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware
27. Yahoo to pay up to $85m to settle data breach lawsuit
28. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
29. Apple's Tim Cook: Our personal data is 'weaponized against us' by you-know-who
30. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
31. US government medical website was hacked that 75,000 personal data was stolen
32. "The resurgence of #VPNFilter #botnet appears to be limited to the Ukraine, but given the ease of infecting targeted systems,
33. Morrisons supermarket: We're taking payroll leak liability fight to UK Supreme Court
34. Pocket iNet ISP exposed 73GB of data including secret keys, plain text passwords
35. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
36. Phishing for knowledge
37. US Department of Defense Expands Bug Bounty Efforts
38. Magecart Attackers Exploit Magento Zero-Days
39. Join us, and @SentinelOne Nov 29, as we discuss fast acting #ransomware remediation, threat hunting, and #AI that stops incongruous
40. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
41. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
42. ISP Provider Exposed 73 Gigabytes of Highly Sensitive Data Including To The Internet
43. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
44. Russian Government-owned research institute linked to Triton attacks
45. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware
46. Survey: Nearly Half of U.S. Adults Experienced a Data Breach in the Past Three Years
47. Marine diesel engines software developed by Auto Maskin has serious vulnerabilities
48. China asks blockchain-based service providers to control user information

ATTACKS

49. Cathay Pacific breach leaks personal data on 9.4 million people
50. Cathay Pacific data breach hits 9.4 million people
51. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
52. Democratic Fundraising Firm Leaks Voter Database, Clients, Fundraisers
53. Cathay Pacific Hit by Data Leak Affecting 9.4M Passengers
54. Supermarket told it must compensate 100,000 workers after payroll data deliberately leaked by rogue employee
55. Information-Stealing Malware Campaign Evades Anti-Virus Detection
56. Cathay Pacific Suffers Data Breach Impacting 9.4 Million Passengers
57. Pocket iNet Leaves 73 GB of Sensitive Data Exposed
58. Yahoo to pay up to $85m to settle data breach lawsuit
59. Tim Cook Blasts Weaponization Of Personal Data And Praises GDPR
60. Pocket iNet Left All Of Its Corporate Passwords, Keys, And Data Exposed
61. Apple's Tim Cook: Our personal data is 'weaponized against us' by you-know-who
62. A #ZeroDay in #jQuery File Upload could affect thousands of projects because the jQuery #plugin vulnerability has existed for eight
63. Phishing Attack Tip 1: Beware of Unsettling Content An email containing unsettling, startling, or urgent content that requires immediate action on
64. Last year the @USAgov required agencies to implement #DMARC records and policies by October 2018. Learn just how hard DMARC
65. Discover how #NetSpectre attacks leak data remotely via side-channels with Michael Cobb of @thehairyITdog.
66. Yahoo Agrees to Pay $50 Million in Damages to Settle Data Breach Lawsuit
67. Business Email Compromise: Gift Cards
68. The Enduring Password Conundrum
69. US government medical website was hacked that 75,000 personal data was stolen
70. Morrisons supermarket: We're taking payroll leak liability fight to UK Supreme Court
71. Pocket iNet ISP exposed 73GB of data including secret keys, plain text passwords
72. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
73. Phishing for knowledge
74. Phishing attacks: Why is email still such an easy target for hackers?
75. Yahoo agrees to pay $50 million to settle data breach lawsuit
76. My Health Record opt-outs now sit at over 1.1 million
77. ISP Provider Exposed 73 Gigabytes of Highly Sensitive Data Including To The Internet
78. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
79. Office 365 for Business - from May to September - has been Recorded Lowest Phish Miss Rate Versus Rivals
80. Again Hacker Exposed New Microsoft Unpatched Zero-day Bug In Twitter With PoC
81. Yahoo to pay at least $85m for data breach settlement
82. Area 1 Security releases Pay-Per-Phish, the performance-based cybersecurity solution
83. Survey: Nearly Half of U.S. Adults Experienced a Data Breach in the Past Three Years
84. A recent @HealthCareGov #breach exposed unknown types of data on 75,000 people, but a lack of information in the disclosure

THREATS

85. ​Australian woman arrested over AU$450,000 Ripple theft
86. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
87. Windows ‘Deletebug’ Zero-Day Allows Privilege Escalation, Destruction
88. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
89. Vulnerabilities in Linksys Routers May Grant Attackers Full Control
90. Information-Stealing Malware Campaign Evades Anti-Virus Detection
91. New Malware Targets Industrial Control Systems
92. FlawedAmmyy Remote Access Trojan
93. Exploit for New Windows Zero-Day Published on Twitter
94. Cisco Patches Local WebEx Vulnerability, Remotely Exploitable in AD Deployments
95. Meet the malware which turns your smartphone into a mobile proxy
96. CVE-2018-4338: Triggering an Information Disclosure on macOS Through a Broadcom AirPort Kext
97. Meet Cryptojacking, the (not so) new kid on the block
98. sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting
99. ThreatList: Ransomware, EKs and Trojans lead the Way in Q3 Malware Trends
100. Another Windows 0-day flaw has been published on Twitter
101. .@Siemens disclosed six SICLOCK flaws that were found within its central plant clocks. Discover why three flaws have been rated
102. Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware
103. Mac malware intercepts encrypted web traffic for ad injection
104. SandboxEscaper expert is back and disclosed a new Windows Zero-Day
105. Pentagon Launches Continuous Bug Bounty Program
106. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
107. [SingCERT] Alert on Drupal Critical Vulnerabilities
108. A Windows 0day vulnerability was made public on Twitter
109. Organizations with strong DevSecOps find flaws 11x faster than those without
110. New Microsoft Windows Zero-Day Dropped on Twitter, Micropatch Available
111. A #ZeroDay in #jQuery File Upload could affect thousands of projects because the jQuery #plugin vulnerability has existed for eight
112. Most enterprise vulnerabilities remain unpatched a month after discovery
113. WizCase Found Critical Firmware Vulnerabilities In Leading NAS Devices
114. New Windows Zero-Day Bug Helps Delete Any File, Exploit Available
115. Twitter User Discloses Second Microsoft Zero-Day
116. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
117. Firefox 63 Released with Enhanced Tracking Protection and Fixes 14 Security Vulnerabilities
118. Most applications 'suffer from information leakage bugs'
119. DoD bug bounty program to expand to more sensitive systems
120. LuminosityLink RAT author sentenced to 2.5 years in jail
121. 3-year-old jQuery plugin vulnerability finally patched
122. US Department of Defense Expands Bug Bounty Efforts
123. The Qihoo @360CoreSec team found a @Microsoft vulnerability -- named Double Kill -- that affects applications through #MicrosoftOffice documents. Learn
124. Join us, and @SentinelOne Nov 29, as we discuss fast acting #ransomware remediation, threat hunting, and #AI that stops incongruous
125. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
126. FBI: Call of Duty gamers helped steal $3.3 million in cryptocurrency hacking scheme
127. Good initiative. Would be even better if you would pay bounties for the bugs, too.
128. Learn about the #NetSpectre vulnerability and the benefits of #ThreatModeling for cloud deployments from expert Ed Moyle of @securitycurve.
129. Crytojacking 101; why cryptojacking is bad for business
130. A summer intern took a look at tinc VPN, they found some nice authentication bypass and message tampering flaws
131. Beyond Your Bank Account: Ten Astounding Finds Uncovered by Financial Malware
132. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware
133. Again Hacker Exposed New Microsoft Unpatched Zero-day Bug In Twitter With PoC
134. How Microsoft's Controlled Folder Access can help stop ransomware
135. Marine diesel engines software developed by Auto Maskin has serious vulnerabilities
136. Drupal Remote Code Execution Vulnerability Threat Alert
137. China asks blockchain-based service providers to control user information
138. A Digital Currency for Everyone: 5 Easy Way Steps to Follow for Buying Bitcoin
139. Hacker Discloses New Windows Zero-Day Exploit On Twitter
140. Securing Blockchain with Privileged Access Management

CRIME

141. ​Australian woman arrested over AU$450,000 Ripple theft
142. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
143. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
144. Magecart hackers change tactic and target vulnerable Magento extensions
145. Federal Legislation Enables Consumers to Obtain Security Freezes on Credit Reports Free of Charge
146. Yahoo to pay up to $85m to settle data breach lawsuit
147. Business Email Compromise: Gift Cards
148. US government medical website was hacked that 75,000 personal data was stolen
149. Morrisons supermarket: We're taking payroll leak liability fight to UK Supreme Court
150. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
151. LuminosityLink RAT author sentenced to 2.5 years in jail
152. Phishing for knowledge
153. FBI: Call of Duty gamers helped steal $3.3 million in cryptocurrency hacking scheme
154. Beyond Your Bank Account: Ten Astounding Finds Uncovered by Financial Malware
155. Survey: Nearly Half of U.S. Adults Experienced a Data Breach in the Past Three Years
156. China asks blockchain-based service providers to control user information
157. Securing Blockchain with Privileged Access Management

POLITICS

158. New Malware Targets Industrial Control Systems
159. Meet Cryptojacking, the (not so) new kid on the block
160. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
161. Pocket iNet ISP exposed 73GB of data including secret keys, plain text passwords
162. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
163. Phishing for knowledge
164. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
165. ISP Provider Exposed 73 Gigabytes of Highly Sensitive Data Including To The Internet
166. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
167. Russian Government-owned research institute linked to Triton attacks

APT report for 2018-10-23

TRANSNATIONAL / UNKNOWN

1. Magecart group leverages zero-days in 20 Magento extensions
2. NSA Tools Used to Attack Nuclear Energy Firms
3. Hacking operations with DarkPulsar and other tools developed by the NSA

CHINA

4. Chinese Cyber Espionage Group using Datper Trojan

INDIA

Nil

NORTH KOREA

5. North Korean Hackers Stole $571 Million Worth of CryptoCoins in Less Than 24 Months

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

6. Experts advocate for 'ATT&CK' as go-to framework to share threat intel
7. FireEye links Russia-owned lab to Trisis developers

SERBIA

Nil

UKRAINE

8. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers

Platform report for 2018-10-23

WINDOWS

1. Microsoft Windows zero-day disclosed on Twitter, again
2. When Ransomware Stopped Working Harder and Started Working Smarter
3. Chalubo DDoS Botnet Compromises Linux SSH Servers Using Brute-Force Attacks
4. Bots Targeting SSH Servers and Brute-Forcing Entry
5. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers
6. NSA Tools Used to Attack Nuclear Energy Firms
7. Hacking operations with DarkPulsar and other tools developed by the NSA
8. Windows 10 1809 Zip Extraction Bug Overwrites Files without Confirmation

LINUX

9. Chalubo DDoS Botnet Compromises Linux SSH Servers Using Brute-Force Attacks
10. Bots Targeting SSH Servers and Brute-Forcing Entry

UNIX

Nil

ANDROID

Nil

IOS

11. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw
12. Apple has launched its university ID Cards feature in Wallet. Students at three universities can now access their student ID

MACOS

13. Inside Safari Extensions | Malicious Plugins Remain on Mojave
14. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw

Threat report for 2018-10-23

DATA BREACH & DATA LOSS

1. Case Study: Protecting PII
2. An ISP Left Corporate Passwords, Keys, and All its Data Exposed on the Internet
3. Top 10 security steps in Microsoft 365 that political campaigns can take today
4. Critical vulnerabilities in FreeRTOS allowed for IoT device compromise
5. Thousands of applications affected by a zero-day issue injQuery File Upload plugin
6. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
7. Identify when your data is exposed, your brand is abused, or your company is mentioned on the dark web. Test
8. Thousands of Applications Vulnerable to RCE via jQuery File Upload
9. Facebook has seen several data breaches in the last few months, leading the company to look into acquiring a
10. Police have issued a fresh warning concerning Fortnite and players giving out their personal details online. Cheshire Police posted on Facebook,
11. Adult websites shuttered after 1.2 million user details exposed
12. #sLoad and #Ramnit pairing in sustained personalized campaigns against UK and Italy
13. jQuery? More like preyQuery: File upload tool can be exploited to hijack at-risk websites
14. "Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
15. “We’re less likely to be caught up in a massive breach of highly available PII or financial data that gets
16. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
17. Morrisons loses appeal over data breach
18. Morrisons loses appeal against data breach liability ruling
19. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may

DENIAL-OF-SERVICE

20. DDoS-Capable IoT Botnet 'Chalubo' Rises
21. Chalubo DDoS Botnet Compromises Linux SSH Servers Using Brute-Force Attacks
22. Netscout Launches Arbor Edge Defense for Enterprise DDoS Security
23. Oracle Doubles Down on Cloud Security With CASB, WAF, DDoS Protection

MALVERTISING

Nil

PHISHING

24. Phishing is still the most commonly used attack on organizations, survey says
25. New Phishing Attack That Uses Multiple Replica Sign-In Pages
26. How sophisticated phishing grants attackers total control of your computer
27. How sophisticated phishing grants attackers total control of your computer
28. 5 Ways #Cybercriminals Can Access Your Emails Without Phishing [Infographic]:
29. Phishing attacks becoming more targeted, phishers love Microsoft the most
30. Learn how hackers launched #phishing attacks against @netflix users with expert Michael Cobb of @thehairyITdog
31. "Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
32. Phishing Report Shows Microsoft, Paypal, & Netflix as Top Targets
33. 4 suggerimenti per utilizzare al meglio il vostro #password manager e generare password davvero efficaci. Ebbene sì, repetita juvant :)

WEB DEFACEMENT

34. Hackers Defaced Davos In The Desert To Show Image Of Murdered Journalist
35. Saudi Investment Site Defaced After Journalist’s Murder

BOTNET

36. DDoS-Capable IoT Botnet 'Chalubo' Rises
37. Chalubo DDoS Botnet Compromises Linux SSH Servers Using Brute-Force Attacks
38. Battling Bots: How to Find Fake Twitter Followers
39. Bots Targeting SSH Servers and Brute-Forcing Entry

RANSOMWARE

40. When Ransomware Stopped Working Harder and Started Working Smarter
41. City Pays $2K in Ransomware, Stirs ‘Never Pay’ Debate
42. Case Study: Ransomware
43. Indiana National Guard Suffers Ransomware Attack
44. Indiana National Guard hit by ransomware
45. Have you ever wondered why #ransomware attacks happen on the Friday before a long weekend? We've teamed up with @SentinelOne

CRYPTOMINING & CRYPTOCURRENCIES

46. Why the blockchain is not secure
47. Trade.io Cold Wallet Hacked Losing 50 Million TIO Tokens – TIO Coin To Be Forked
48. Why is Elon Musk promoting this Bitcoin scam? (He’s not)
49. Report: Cryptocurrency hackers earned $20M with 51-percent attacks in 2018
50. Apple has launched its university ID Cards feature in Wallet. Students at three universities can now access their student ID
51. Can Cybercriminals Hack Blockchain?
52. A Beginner’s Guide to Bitcoin Mining (Bitcoin Mining 101)

MALWARE

53. Burned malware returns, according to Cylance: is Hacking Team responsible?
54. Status of Today’s Email as a Malware Vector
55. Case Study: Destructive Malware
56. Banking Trojan Infections Persist Throughout the State
57. Triton Malware Linked to Russian Government Research Institute
58. FireEye links Russian research lab to Triton ICS malware attacks
59. Securing Government Operations with Cloud-based Malware Analysis
60. How RATs infect computers with malicious software
61. This is how government spyware StrongPity uses security researchers' work against them
62. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
63. Inside Safari Extensions | Malicious Plugins Remain on Mojave
64. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
65. H-Worm and jRAT Malware: Two RATs are Better than One
66. How RATs infect computers with malicious software
67. What do you think the combination of the #TrickBot banking Trojan to #IcedID means for the future of banking #Trojans?
68. Updated Azorult malware for sale on the Dark Web
69. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
70. Chinese Cyber Espionage Group using Datper Trojan
71. Burned malware returns, says Cylance report: Is Hacking Team responsible?

EXPLOIT

Nil

VULNERABILITY

72. DHS warns of another dangerous flaw in Advantech WebAccess SCADA software
73. Microsoft Windows zero-day disclosed on Twitter, again
74. AWS FreeRTOS Riddled with Security Vulnerabilities | Avast
75. Critical vulnerabilities in FreeRTOS allowed for IoT device compromise
76. Thousands of applications affected by a zero-day issue injQuery File Upload plugin
77. Grave TCP/IP Flaws In FreeRTOS Leave IoT Gear Open To Mass Hijacking
78. Patch now! Multiple serious flaws found in Drupal
79. Quantifying Vulnerability Risk: How to Quickly Calculate and Prioritize Risk
80. Amazon Patched Multiple IoT Vulnerabilities Affecting Its Smart Devices
81. Amazon patches IoT and critical infrastructure security flaws
82. Patch me, if you can: Grave TCP/IP flaws in FreeRTOS leave IoT gear open to mass hijacking
83. Several vulnerabilities were found in controllers made by @Universal_Robot. Discover what these #robot controllers are used for and how
84. How do newly found flaws affect robot controllers?
85. Firmware zero-day leaves 2m storage devices open to RCE
86. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
87. CyberSecurity Asean security alert on Multiple Vulnerabilities in Cisco WebEx Network Recording Player for Advanced Recording Format Files Could Allow for Arbitrary Code Execution
88. Bug Spells Doom for Nearly-Vacant Google+ Network
89. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw
90. libssh Server-Side Identity Authentication Bypass Vulnerability (CVE-2018-10933)Threat Alert
91. WebLogic Remote Code Execution Vulnerability(CVE-2018-3191)Threat Alert
92. Different Vendors Confirm The Impact Of LibSSH Flaw On Their Products
93. FreeRTOS IoT OS Critical Vulnerabilities Affected Million of Smart Home & Critical Infrastructure Based IoT Devices
94. LIVE555 Streaming library affected by remote code execution vulnerability
95. Windows 10 1809 Zip Extraction Bug Overwrites Files without Confirmation
96. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may

Region brief for 2018-10-23

ASIA

1. FireEye links Russia-owned lab to Trisis developers
2. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
3. Chinese Cyber Espionage Group using Datper Trojan
4. Saudi Investment Site Defaced After Journalist’s Murder
5. NSA Tools Used to Attack Nuclear Energy Firms
6. Burned malware returns, says Cylance report: Is Hacking Team responsible?
7. libssh Server-Side Identity Authentication Bypass Vulnerability (CVE-2018-10933)Threat Alert
8. WebLogic Remote Code Execution Vulnerability(CVE-2018-3191)Threat Alert
9. North Korean Hackers Stole $571 Million Worth of CryptoCoins in Less Than 24 Months
10. Hacking operations with DarkPulsar and other tools developed by the NSA
11. Can Cybercriminals Hack Blockchain?

OCEANIA

Nil

NORTH AMERICA

12. When Ransomware Stopped Working Harder and Started Working Smarter
13. FireEye links Russia-owned lab to Trisis developers
14. An ISP Left Corporate Passwords, Keys, and All its Data Exposed on the Internet
15. Securing Government Operations with Cloud-based Malware Analysis
16. Inside Safari Extensions | Malicious Plugins Remain on Mojave
17. Quantifying Vulnerability Risk: How to Quickly Calculate and Prioritize Risk
18. Phishing attacks becoming more targeted, phishers love Microsoft the most
19. Indiana National Guard hit by ransomware
20. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
21. Saudi Investment Site Defaced After Journalist’s Murder
22. NSA Tools Used to Attack Nuclear Energy Firms
23. Burned malware returns, says Cylance report: Is Hacking Team responsible?
24. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw
25. Can Cybercriminals Hack Blockchain?

SOUTH AMERICA

Nil

EUROPE

26. Experts advocate for 'ATT&CK' as go-to framework to share threat intel
27. FireEye links Russia-owned lab to Trisis developers
28. Triton Malware Linked to Russian Government Research Institute
29. FireEye links Russian research lab to Triton ICS malware attacks
30. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
31. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers
32. #sLoad and #Ramnit pairing in sustained personalized campaigns against UK and Italy
33. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
34. NSA Tools Used to Attack Nuclear Energy Firms
35. “We’re less likely to be caught up in a massive breach of highly available PII or financial data that gets
36. Morrisons loses appeal over data breach
37. Hacking operations with DarkPulsar and other tools developed by the NSA

AFRICA

Nil