Threat report for 2018-10-25

DATA BREACH & DATA LOSS

1. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
2. Cathay Pacific hack: Personal data of up to 9.4 million airline passengers laid bare
3. Another 185K Customers Potentially Affected by the British Airways Data Breach
4. British Airways: Cyberattack, data theft bigger than we first thought
5. Cathay Pacific data breach: 9.4 million passenger information at risk
6. Data Breach Announced by CMS – Approximately 75,000 Individuals’ Files Affected
7. Abandoned Web Apps Found as a Core Cause Behind High Profile Data Breaches
8. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
9. Questions Mount Over Delay After Cathay Pacific Admits Huge Data Leak
10. Multiple Phishing Campaigns Target Universities
11. 77K Additional Customers Affected by British Airways' MageCart Data Breach
12. Cathay Pacific data breach exposes PII of 9.4 million customers
13. Cathay Pacific data breach exposed 9.4m customers’ details
14. Hackers steal personal data of up to 9.4 million Cathay Pacific passengers
15. Hackers steal personal data of up to 9.4 million Cathay Pacific passengers
16. CNI Campaign TRITON Linked to Russian Institute
17. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack
18. Cathay Pacific data breach affecting 9.4 million passengers
19. Data leak at consulting firm handling fundraisers for the Democratic party

DENIAL-OF-SERVICE

20. New DDoS botnet goes after Hadoop enterprise servers
21. New Botnet Launches DDoS Attacks on SSH Servers
22. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack
23. NETSCOUT’s Arbor Cloud Expands DDoS Protection Across Asia

MALVERTISING

Nil

PHISHING

24. Multiple Phishing Campaigns Target Universities
25. Cofense Hunts Phishing Threats Round the Clock with Enhanced 24-hour Global Phishing Defense Services
26. Learn how hackers used TLS certificates to launch @netflix #phishing attacks from expert Michael Cobb of @thehairyITdog
27. iOS 12 has completely blocked password cracking tool, GrayKey

WEB DEFACEMENT

Nil

BOTNET

28. New DDoS botnet goes after Hadoop enterprise servers
29. Hacker creates seven new variants of the Mirai botnet | Avast
30. New Botnet Launches DDoS Attacks on SSH Servers
31. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack

RANSOMWARE

32. Experts released a free Decryption Tool for GandCrab ransomware
33. New FilesLocker Ransomware Offered as a Ransomware as a Service
34. GandCrab ransomware declawed with new decryption tool
35. Files Encrypted by GandCrab Ransomware Can Now Be Decrypted for Free
36. Bitdefender releases GandCrab ransomware decryption tool
37. Free GrandCrab Ransomware Decryption Tool Released by Bitdefender
38. Free Decrypter Available for the Latest GandCrab Ransomware Versions
39. ESET releases new decryptor for Syrian victims of GandCrab ransomware
40. Free decryption tool released for multiple GandCrab ransomware versions
41. West Haven pays $2k USD because of ransomware attack
42. GandCrab Ransomware decryption tool

CRYPTOMINING & CRYPTOCURRENCIES

43. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
44. North Korea blamed for two cryptocurrency scams, five trading platform hacks
45. Building shared digital identity using blockchain technology

MALWARE

46. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
47. Malware Distributors Adopt DKIM to Bypass Mail Filters
48. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
49. Another one bites the dust! In 2018 Android malware can bypass defences of billon dollar AV industry and Google Play
50. 'TimpDoor' Malware Turns Android Devices into Proxies
51. Bypass an Anti Virus Detection with Encrypted Payloads using VENOM Tool
52. #DidYouKnow AVG Free Antivirus received the highest rating of Advanced+ in @AV_Comparatives latest Malware Protection Test? Share AVG Free Antivirus with
53. Malware Distributors Adopt DKIM to Bypass Mail Filters
54. Mac Malware Injects Ads Into Encrypted Traffic
55. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
56. FireEye ties Russia to Triton malware attack in Saudi Arabia
57. Our threat intelligence lead Chris Dawson (@mrdatahs) discussing new @proofpoint Threat Insight #Malware research with @threatpost.
58. FireEye links Triton Malware to Russian Research Institute
59. .@FireEye security researchers claimed the Russian government was 'most likely' behind the Triton #malware attack on an industrial control system
60. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye
61. What is application security? A process and tools for securing software
62. [BLOG] When #malware actor realizes that he can make more money by himself and transform his dropper into banking malware,
63. New Android Malware Turns Your Mobile Devices into Hidden Proxies

EXPLOIT

64. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these

VULNERABILITY

65. New security flaw impacts most Linux and BSD distros
66. Multiple Vulnerabilities Patched in ASRock Drivers
67. Unusual Remote Execution Bug in Cisco WebEx Discovered by Researchers
68. WINDOWS ZERO-DAY BY SANDBOXESCAPER
69. Sophos Patches RCE and Memory Disclosure Vulnerabilities in
70. Vulnerability Spotlight: TALOS-2018-0635/0636 – Sophos HitmanPro.Alert memory disclosure and code execution vulnerabilities
71. Pentagon Expands Bug-Bounty Program to Include Physical Systems
72. Researchers Find Command Injection Flaw in Cisco WebEx
73. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
74. Microsoft Acknowledges Zip File Overwrite Bug - Fix Coming in November
75. Cisco releases fix for privilege escalation bug in Webex Meetings app
76. Amazon IoT operating system FreeRTOS has serious vulnerabilities
77. Experts discovered a severe command injection flaw in Cisco Webex Meetings Desktop
78. You patch my back(up) and I'll patch yours... Arcserve bugs burrow remotely exploited holes in UDP storage systems
79. Signal Desktop App Vulnerability Exposes Message Decryption Key To The Users
80. Vulnerability Spotlight: TALOS-2018-0635/0636 - Sophos HitmanPro.Alert memory disclosure and code execution vulnerabilities
81. Windows 10 Update Fixed File Deletion Flaw But Not ZIP File Overwrite Bug
82. Google Chrome 70.0.3538.77 released: Bugs fix
83. Win10 1803 big bug bash KB 4462933 joins earlier versions, a week late to the party
84. FreeRTOS Multiple Remote Code Execution Vulnerabilities Threat Alert
85. Java Usage Tracker Vulnerability
86. Windows 10 bug overwrites files without confirmation
87. Unusual Remote Execution Bug in Cisco WebEx Discovered by Researchers

Region brief for 2018-10-25

ASIA

1. Experts released a free Decryption Tool for GandCrab ransomware
2. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
3. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
4. New FilesLocker Ransomware Offered as a Ransomware as a Service
5. Cathay Pacific data breach: 9.4 million passenger information at risk
6. Questions Mount Over Delay After Cathay Pacific Admits Huge Data Leak
7. North Korea blamed for two cryptocurrency scams, five trading platform hacks
8. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
9. FireEye ties Russia to Triton malware attack in Saudi Arabia
10. Cathay Pacific data breach exposed 9.4m customers’ details
11. CNI Campaign TRITON Linked to Russian Institute
12. ESET releases new decryptor for Syrian victims of GandCrab ransomware
13. Cathay Pacific data breach affecting 9.4 million passengers
14. .@FireEye security researchers claimed the Russian government was 'most likely' behind the Triton #malware attack on an industrial control system
15. FreeRTOS Multiple Remote Code Execution Vulnerabilities Threat Alert
16. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye
17. NETSCOUT’s Arbor Cloud Expands DDoS Protection Across Asia

OCEANIA

18. NETSCOUT’s Arbor Cloud Expands DDoS Protection Across Asia

NORTH AMERICA

19. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
20. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
21. Malware Distributors Adopt DKIM to Bypass Mail Filters
22. Data Breach Announced by CMS – Approximately 75,000 Individuals’ Files Affected
23. Abandoned Web Apps Found as a Core Cause Behind High Profile Data Breaches
24. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
25. Multiple Phishing Campaigns Target Universities
26. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed
27. 5 Common Visibility Gaps Your Enterprise Security Plan Can’t Afford
28. Malware Distributors Adopt DKIM to Bypass Mail Filters
29. West Haven pays $2k USD because of ransomware attack
30. GandCrab Ransomware decryption tool

SOUTH AMERICA

Nil

EUROPE

31. Experts released a free Decryption Tool for GandCrab ransomware
32. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
33. British Airways has some good news and bad news about its payment breach
34. Another 185K Customers Potentially Affected by the British Airways Data Breach
35. British Airways: Cyberattack, data theft bigger than we first thought
36. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
37. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
38. Multiple Phishing Campaigns Target Universities
39. 77K Additional Customers Affected by British Airways' MageCart Data Breach
40. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed
41. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
42. Bitdefender releases GandCrab ransomware decryption tool
43. FireEye ties Russia to Triton malware attack in Saudi Arabia
44. FireEye links Triton Malware to Russian Research Institute
45. CNI Campaign TRITON Linked to Russian Institute
46. Free GrandCrab Ransomware Decryption Tool Released by Bitdefender
47. Cathay Pacific data breach affecting 9.4 million passengers
48. .@FireEye security researchers claimed the Russian government was 'most likely' behind the Triton #malware attack on an industrial control system
49. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye

AFRICA

Nil

Sector brief for 2018-10-25

HEALTHCARE

1. Data Breach Announced by CMS – Approximately 75,000 Individuals’ Files Affected
2. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
3. Amazon IoT operating system FreeRTOS has serious vulnerabilities

TRANSPORT

4. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
5. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
6. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed
7. Amazon IoT operating system FreeRTOS has serious vulnerabilities

BANKING & FINANCE

8. British Airways has some good news and bad news about its payment breach
9. Malware Distributors Adopt DKIM to Bypass Mail Filters
10. Another 185K Customers Potentially Affected by the British Airways Data Breach
11. British Airways: Cyberattack, data theft bigger than we first thought
12. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
13. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
14. Questions Mount Over Delay After Cathay Pacific Admits Huge Data Leak
15. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed
16. 5 Common Visibility Gaps Your Enterprise Security Plan Can’t Afford
17. Cathay Pacific data breach exposes PII of 9.4 million customers
18. Cathay Pacific data breach affecting 9.4 million passengers
19. West Haven pays $2k USD because of ransomware attack
20. [BLOG] When #malware actor realizes that he can make more money by himself and transform his dropper into banking malware,

INFORMATION & TELECOMMUNICATION

21. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
22. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
23. Another one bites the dust! In 2018 Android malware can bypass defences of billon dollar AV industry and Google Play
24. #DidYouKnow AVG Free Antivirus received the highest rating of Advanced+ in @AV_Comparatives latest Malware Protection Test? Share AVG Free Antivirus with
25. Hacker creates seven new variants of the Mirai botnet | Avast
26. iOS 12 has completely blocked password cracking tool, GrayKey

FOOD

Nil

WATER

Nil

ENERGY

Nil

GOVERNMENT & PUBLIC SERVICE

27. Experts released a free Decryption Tool for GandCrab ransomware
28. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
29. 5 Common Visibility Gaps Your Enterprise Security Plan Can’t Afford
30. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
31. Bitdefender releases GandCrab ransomware decryption tool
32. FireEye links Triton Malware to Russian Research Institute
33. CNI Campaign TRITON Linked to Russian Institute
34. Free GrandCrab Ransomware Decryption Tool Released by Bitdefender
35. .@FireEye security researchers claimed the Russian government was 'most likely' behind the Triton #malware attack on an industrial control system
36. Building shared digital identity using blockchain technology
37. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye
38. West Haven pays $2k USD because of ransomware attack

Daily brief for 2018-10-25

ASIA

1. Experts released a free Decryption Tool for GandCrab ransomware
2. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
3. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
4. New FilesLocker Ransomware Offered as a Ransomware as a Service
5. Cathay Pacific data breach: 9.4 million passenger information at risk
6. Questions Mount Over Delay After Cathay Pacific Admits Huge Data Leak
7. North Korea blamed for two cryptocurrency scams, five trading platform hacks
8. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
9. FireEye ties Russia to Triton malware attack in Saudi Arabia
10. Cathay Pacific data breach exposed 9.4m customers’ details
11. CNI Campaign TRITON Linked to Russian Institute
12. ESET releases new decryptor for Syrian victims of GandCrab ransomware
13. Cathay Pacific data breach affecting 9.4 million passengers
14. .@FireEye security researchers claimed the Russian government was 'most likely' behind the Triton #malware attack on an industrial control system
15. FreeRTOS Multiple Remote Code Execution Vulnerabilities Threat Alert
16. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye
17. NETSCOUT’s Arbor Cloud Expands DDoS Protection Across Asia

WORLD

18. Experts released a free Decryption Tool for GandCrab ransomware
19. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
20. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
21. British Airways has some good news and bad news about its payment breach
22. Malware Distributors Adopt DKIM to Bypass Mail Filters
23. Another 185K Customers Potentially Affected by the British Airways Data Breach
24. British Airways: Cyberattack, data theft bigger than we first thought
25. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
26. Data Breach Announced by CMS – Approximately 75,000 Individuals’ Files Affected
27. Abandoned Web Apps Found as a Core Cause Behind High Profile Data Breaches
28. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
29. Multiple Phishing Campaigns Target Universities
30. 77K Additional Customers Affected by British Airways' MageCart Data Breach
31. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed
32. 5 Common Visibility Gaps Your Enterprise Security Plan Can’t Afford
33. Malware Distributors Adopt DKIM to Bypass Mail Filters
34. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
35. Bitdefender releases GandCrab ransomware decryption tool
36. FireEye ties Russia to Triton malware attack in Saudi Arabia
37. FireEye links Triton Malware to Russian Research Institute
38. CNI Campaign TRITON Linked to Russian Institute
39. Free GrandCrab Ransomware Decryption Tool Released by Bitdefender
40. Cathay Pacific data breach affecting 9.4 million passengers
41. .@FireEye security researchers claimed the Russian government was 'most likely' behind the Triton #malware attack on an industrial control system
42. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye
43. West Haven pays $2k USD because of ransomware attack
44. NETSCOUT’s Arbor Cloud Expands DDoS Protection Across Asia
45. GandCrab Ransomware decryption tool

ATTACKS

46. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
47. Cathay Pacific hack: Personal data of up to 9.4 million airline passengers laid bare
48. Another 185K Customers Potentially Affected by the British Airways Data Breach
49. British Airways: Cyberattack, data theft bigger than we first thought
50. Cathay Pacific data breach: 9.4 million passenger information at risk
51. Data Breach Announced by CMS – Approximately 75,000 Individuals’ Files Affected
52. Abandoned Web Apps Found as a Core Cause Behind High Profile Data Breaches
53. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
54. Questions Mount Over Delay After Cathay Pacific Admits Huge Data Leak
55. Multiple Phishing Campaigns Target Universities
56. 77K Additional Customers Affected by British Airways' MageCart Data Breach
57. Cofense Hunts Phishing Threats Round the Clock with Enhanced 24-hour Global Phishing Defense Services
58. Cathay Pacific data breach exposes PII of 9.4 million customers
59. Cathay Pacific data breach exposed 9.4m customers’ details
60. Hackers steal personal data of up to 9.4 million Cathay Pacific passengers
61. Hackers steal personal data of up to 9.4 million Cathay Pacific passengers
62. CNI Campaign TRITON Linked to Russian Institute
63. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack
64. Cathay Pacific data breach affecting 9.4 million passengers
65. Learn how hackers used TLS certificates to launch @netflix #phishing attacks from expert Michael Cobb of @thehairyITdog
66. iOS 12 has completely blocked password cracking tool, GrayKey
67. Data leak at consulting firm handling fundraisers for the Democratic party

THREATS

68. New security flaw impacts most Linux and BSD distros
69. Experts released a free Decryption Tool for GandCrab ransomware
70. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
71. Malware Distributors Adopt DKIM to Bypass Mail Filters
72. Multiple Vulnerabilities Patched in ASRock Drivers
73. Unusual Remote Execution Bug in Cisco WebEx Discovered by Researchers
74. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
75. WINDOWS ZERO-DAY BY SANDBOXESCAPER
76. New FilesLocker Ransomware Offered as a Ransomware as a Service
77. Another one bites the dust! In 2018 Android malware can bypass defences of billon dollar AV industry and Google Play
78. Sophos Patches RCE and Memory Disclosure Vulnerabilities in
79. Vulnerability Spotlight: TALOS-2018-0635/0636 – Sophos HitmanPro.Alert memory disclosure and code execution vulnerabilities
80. Pentagon Expands Bug-Bounty Program to Include Physical Systems
81. GandCrab ransomware declawed with new decryption tool
82. Researchers Find Command Injection Flaw in Cisco WebEx
83. Files Encrypted by GandCrab Ransomware Can Now Be Decrypted for Free
84. 'TimpDoor' Malware Turns Android Devices into Proxies
85. North Korea blamed for two cryptocurrency scams, five trading platform hacks
86. Bypass an Anti Virus Detection with Encrypted Payloads using VENOM Tool
87. #DidYouKnow AVG Free Antivirus received the highest rating of Advanced+ in @AV_Comparatives latest Malware Protection Test? Share AVG Free Antivirus with
88. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
89. Microsoft Acknowledges Zip File Overwrite Bug - Fix Coming in November
90. Malware Distributors Adopt DKIM to Bypass Mail Filters
91. Mac Malware Injects Ads Into Encrypted Traffic
92. Cisco releases fix for privilege escalation bug in Webex Meetings app
93. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
94. Bitdefender releases GandCrab ransomware decryption tool
95. Amazon IoT operating system FreeRTOS has serious vulnerabilities
96. FireEye ties Russia to Triton malware attack in Saudi Arabia
97. Our threat intelligence lead Chris Dawson (@mrdatahs) discussing new @proofpoint Threat Insight #Malware research with @threatpost.
98. FireEye links Triton Malware to Russian Research Institute
99. Experts discovered a severe command injection flaw in Cisco Webex Meetings Desktop
100. You patch my back(up) and I'll patch yours... Arcserve bugs burrow remotely exploited holes in UDP storage systems
101. Free GrandCrab Ransomware Decryption Tool Released by Bitdefender
102. Free Decrypter Available for the Latest GandCrab Ransomware Versions
103. Signal Desktop App Vulnerability Exposes Message Decryption Key To The Users
104. ESET releases new decryptor for Syrian victims of GandCrab ransomware
105. Vulnerability Spotlight: TALOS-2018-0635/0636 - Sophos HitmanPro.Alert memory disclosure and code execution vulnerabilities
106. Free decryption tool released for multiple GandCrab ransomware versions
107. .@FireEye security researchers claimed the Russian government was 'most likely' behind the Triton #malware attack on an industrial control system
108. Windows 10 Update Fixed File Deletion Flaw But Not ZIP File Overwrite Bug
109. Google Chrome 70.0.3538.77 released: Bugs fix
110. Win10 1803 big bug bash KB 4462933 joins earlier versions, a week late to the party
111. Building shared digital identity using blockchain technology
112. FreeRTOS Multiple Remote Code Execution Vulnerabilities Threat Alert
113. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye
114. Java Usage Tracker Vulnerability
115. Windows 10 bug overwrites files without confirmation
116. West Haven pays $2k USD because of ransomware attack
117. Unusual Remote Execution Bug in Cisco WebEx Discovered by Researchers
118. What is application security? A process and tools for securing software
119. [BLOG] When #malware actor realizes that he can make more money by himself and transform his dropper into banking malware,
120. New Android Malware Turns Your Mobile Devices into Hidden Proxies
121. GandCrab Ransomware decryption tool

CRIME

122. Another 185K Customers Potentially Affected by the British Airways Data Breach
123. British Airways: Cyberattack, data theft bigger than we first thought
124. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
125. Multiple Phishing Campaigns Target Universities
126. 5 Common Visibility Gaps Your Enterprise Security Plan Can’t Afford
127. Cofense Hunts Phishing Threats Round the Clock with Enhanced 24-hour Global Phishing Defense Services
128. Hackers steal personal data of up to 9.4 million Cathay Pacific passengers
129. Cathay Pacific data breach affecting 9.4 million passengers

POLITICS

130. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye

APT report for 2018-10-24

TRANSNATIONAL / UNKNOWN

1. Magecart hackers change tactic and target vulnerable Magento extensions
2. Magecart Cybergang Targets 0days in Third-Party Magento Extensions
3. Magecart Hackers Now Targeting Vulnerable Magento Extensions
4. Magecart Attackers Exploit Magento Zero-Days

CHINA

5. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
6. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign

INDIA

7. Federal Legislation Enables Consumers to Obtain Security Freezes on Credit Reports Free of Charge

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

8. New Malware Targets Industrial Control Systems
9. Need help managing supply chain risks? In this week's ShadowTalk episode, the team breaks it down into hardware, software
10. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
11. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
12. The risk to OT networks is real, and it’s dangerous for business leaders to ignore
13. Russian Government-owned research institute linked to Triton attacks
14. NETSCOUT Takes Internet Scale Threat Protection to the Edge
15. .@RobertMLee said #GreyEnergy is a threat, but people shouldn't conclude from @ESET research that the group will only target

SERBIA

Nil

UKRAINE

16. Russian Government-owned research institute linked to Triton attacks

Platform report for 2018-10-24

WINDOWS

1. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
2. Windows ‘Deletebug’ Zero-Day Allows Privilege Escalation, Destruction
3. Exploit for New Windows Zero-Day Published on Twitter
4. Cisco Patches Local WebEx Vulnerability, Remotely Exploitable in AD Deployments
5. CVE-2018-4338: Triggering an Information Disclosure on macOS Through a Broadcom AirPort Kext
6. Meet Cryptojacking, the (not so) new kid on the block
7. Exploit kits: fall 2018 review
8. Another Windows 0-day flaw has been published on Twitter
9. SandboxEscaper expert is back and disclosed a new Windows Zero-Day
10. A Windows 0day vulnerability was made public on Twitter
11. New Microsoft Windows Zero-Day Dropped on Twitter, Micropatch Available
12. New Windows Zero-Day Bug Helps Delete Any File, Exploit Available
13. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
14. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
15. The risk to OT networks is real, and it’s dangerous for business leaders to ignore
16. Russian Government-owned research institute linked to Triton attacks
17. Again Hacker Exposed New Microsoft Unpatched Zero-day Bug In Twitter With PoC
18. How Microsoft's Controlled Folder Access can help stop ransomware
19. Hacker Discloses New Windows Zero-Day Exploit On Twitter

LINUX

20. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
21. Meet Cryptojacking, the (not so) new kid on the block
22. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
23. Chalubo, a new IoT botnet emerges in the threat landscape

UNIX

Nil

ANDROID

24. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
25. Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware
26. Marine diesel engines software developed by Auto Maskin has serious vulnerabilities

IOS

27. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
28. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records

MACOS

29. CVE-2018-4338: Triggering an Information Disclosure on macOS Through a Broadcom AirPort Kext
30. Meet Cryptojacking, the (not so) new kid on the block
31. Mac malware intercepts encrypted web traffic for ad injection

Threat report for 2018-10-24

DATA BREACH & DATA LOSS

1. Cathay Pacific breach leaks personal data on 9.4 million people
2. Cathay Pacific data breach hits 9.4 million people
3. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
4. Democratic Fundraising Firm Leaks Voter Database, Clients, Fundraisers
5. Cathay Pacific Hit by Data Leak Affecting 9.4M Passengers
6. Supermarket told it must compensate 100,000 workers after payroll data deliberately leaked by rogue employee
7. Information-Stealing Malware Campaign Evades Anti-Virus Detection
8. Cathay Pacific Suffers Data Breach Impacting 9.4 Million Passengers
9. Pocket iNet Leaves 73 GB of Sensitive Data Exposed
10. Yahoo to pay up to $85m to settle data breach lawsuit
11. Tim Cook Blasts Weaponization Of Personal Data And Praises GDPR
12. Pocket iNet Left All Of Its Corporate Passwords, Keys, And Data Exposed
13. Apple's Tim Cook: Our personal data is 'weaponized against us' by you-know-who
14. A #ZeroDay in #jQuery File Upload could affect thousands of projects because the jQuery #plugin vulnerability has existed for eight
15. Last year the @USAgov required agencies to implement #DMARC records and policies by October 2018. Learn just how hard DMARC
16. Discover how #NetSpectre attacks leak data remotely via side-channels with Michael Cobb of @thehairyITdog.
17. Yahoo Agrees to Pay $50 Million in Damages to Settle Data Breach Lawsuit
18. Business Email Compromise: Gift Cards
19. US government medical website was hacked that 75,000 personal data was stolen
20. Morrisons supermarket: We're taking payroll leak liability fight to UK Supreme Court
21. Pocket iNet ISP exposed 73GB of data including secret keys, plain text passwords
22. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
23. Yahoo agrees to pay $50 million to settle data breach lawsuit
24. My Health Record opt-outs now sit at over 1.1 million
25. ISP Provider Exposed 73 Gigabytes of Highly Sensitive Data Including To The Internet
26. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
27. Again Hacker Exposed New Microsoft Unpatched Zero-day Bug In Twitter With PoC
28. Yahoo to pay at least $85m for data breach settlement
29. Survey: Nearly Half of U.S. Adults Experienced a Data Breach in the Past Three Years
30. A recent @HealthCareGov #breach exposed unknown types of data on 75,000 people, but a lack of information in the disclosure

DENIAL-OF-SERVICE

31. This botnet snares your smart devices to perform DDoS attacks with a little help from Mirai

MALVERTISING

Nil

PHISHING

32. Phishing Attack Tip 1: Beware of Unsettling Content An email containing unsettling, startling, or urgent content that requires immediate action on
33. The Enduring Password Conundrum
34. Phishing for knowledge
35. Phishing attacks: Why is email still such an easy target for hackers?
36. Office 365 for Business - from May to September - has been Recorded Lowest Phish Miss Rate Versus Rivals
37. Area 1 Security releases Pay-Per-Phish, the performance-based cybersecurity solution

WEB DEFACEMENT

Nil

BOTNET

38. Poorly secured SSH servers targeted by Chalubo botnet
39. This botnet snares your smart devices to perform DDoS attacks with a little help from Mirai
40. "The resurgence of #VPNFilter #botnet appears to be limited to the Ukraine, but given the ease of infecting targeted systems,
41. Chalubo, a new IoT botnet emerges in the threat landscape

RANSOMWARE

42. ThreatList: Ransomware, EKs and Trojans lead the Way in Q3 Malware Trends
43. Join us, and @SentinelOne Nov 29, as we discuss fast acting #ransomware remediation, threat hunting, and #AI that stops incongruous
44. How Microsoft's Controlled Folder Access can help stop ransomware

CRYPTOMINING & CRYPTOCURRENCIES

45. ​Australian woman arrested over AU$450,000 Ripple theft
46. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
47. Meet Cryptojacking, the (not so) new kid on the block
48. FBI: Call of Duty gamers helped steal $3.3 million in cryptocurrency hacking scheme
49. Crytojacking 101; why cryptojacking is bad for business
50. China asks blockchain-based service providers to control user information
51. A Digital Currency for Everyone: 5 Easy Way Steps to Follow for Buying Bitcoin
52. Securing Blockchain with Privileged Access Management

MALWARE

53. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
54. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
55. Information-Stealing Malware Campaign Evades Anti-Virus Detection
56. New Malware Targets Industrial Control Systems
57. FlawedAmmyy Remote Access Trojan
58. Meet the malware which turns your smartphone into a mobile proxy
59. sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting
60. ThreatList: Ransomware, EKs and Trojans lead the Way in Q3 Malware Trends
61. Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware
62. Mac malware intercepts encrypted web traffic for ad injection
63. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
64. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
65. LuminosityLink RAT author sentenced to 2.5 years in jail
66. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
67. Beyond Your Bank Account: Ten Astounding Finds Uncovered by Financial Malware
68. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware

EXPLOIT

69. Exploit for New Windows Zero-Day Published on Twitter
70. Exploit kits: fall 2018 review
71. New Windows Zero-Day Bug Helps Delete Any File, Exploit Available
72. Siemens Siclock: How do threat actors exploit these devices?
73. Magecart Attackers Exploit Magento Zero-Days
74. Hacker Discloses New Windows Zero-Day Exploit On Twitter

VULNERABILITY

75. Windows ‘Deletebug’ Zero-Day Allows Privilege Escalation, Destruction
76. Vulnerabilities in Linksys Routers May Grant Attackers Full Control
77. Exploit for New Windows Zero-Day Published on Twitter
78. Cisco Patches Local WebEx Vulnerability, Remotely Exploitable in AD Deployments
79. CVE-2018-4338: Triggering an Information Disclosure on macOS Through a Broadcom AirPort Kext
80. Another Windows 0-day flaw has been published on Twitter
81. .@Siemens disclosed six SICLOCK flaws that were found within its central plant clocks. Discover why three flaws have been rated
82. SandboxEscaper expert is back and disclosed a new Windows Zero-Day
83. Pentagon Launches Continuous Bug Bounty Program
84. [SingCERT] Alert on Drupal Critical Vulnerabilities
85. A Windows 0day vulnerability was made public on Twitter
86. Organizations with strong DevSecOps find flaws 11x faster than those without
87. New Microsoft Windows Zero-Day Dropped on Twitter, Micropatch Available
88. A #ZeroDay in #jQuery File Upload could affect thousands of projects because the jQuery #plugin vulnerability has existed for eight
89. Most enterprise vulnerabilities remain unpatched a month after discovery
90. WizCase Found Critical Firmware Vulnerabilities In Leading NAS Devices
91. New Windows Zero-Day Bug Helps Delete Any File, Exploit Available
92. Twitter User Discloses Second Microsoft Zero-Day
93. Firefox 63 Released with Enhanced Tracking Protection and Fixes 14 Security Vulnerabilities
94. Most applications 'suffer from information leakage bugs'
95. DoD bug bounty program to expand to more sensitive systems
96. 3-year-old jQuery plugin vulnerability finally patched
97. US Department of Defense Expands Bug Bounty Efforts
98. The Qihoo @360CoreSec team found a @Microsoft vulnerability -- named Double Kill -- that affects applications through #MicrosoftOffice documents. Learn
99. Good initiative. Would be even better if you would pay bounties for the bugs, too.
100. Learn about the #NetSpectre vulnerability and the benefits of #ThreatModeling for cloud deployments from expert Ed Moyle of @securitycurve.
101. A summer intern took a look at tinc VPN, they found some nice authentication bypass and message tampering flaws
102. Again Hacker Exposed New Microsoft Unpatched Zero-day Bug In Twitter With PoC
103. Marine diesel engines software developed by Auto Maskin has serious vulnerabilities
104. Drupal Remote Code Execution Vulnerability Threat Alert
105. Hacker Discloses New Windows Zero-Day Exploit On Twitter

Region brief for 2018-10-24

ASIA

1. Cathay Pacific breach leaks personal data on 9.4 million people
2. Democratic Fundraising Firm Leaks Voter Database, Clients, Fundraisers
3. Cathay Pacific Hit by Data Leak Affecting 9.4M Passengers
4. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
5. Exploit kits: fall 2018 review
6. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
7. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
8. Phishing for knowledge
9. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
10. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
11. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
12. Russian Government-owned research institute linked to Triton attacks
13. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware
14. Drupal Remote Code Execution Vulnerability Threat Alert
15. China asks blockchain-based service providers to control user information

OCEANIA

16. ​Australian woman arrested over AU$450,000 Ripple theft
17. Phishing for knowledge

NORTH AMERICA

18. Warning: More iOS Devices Are Infected by Cryptocurrency Mining Malware
19. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
20. Meet Cryptojacking, the (not so) new kid on the block
21. Exploit kits: fall 2018 review
22. Pocket iNet Leaves 73 GB of Sensitive Data Exposed
23. Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware
24. Yahoo to pay up to $85m to settle data breach lawsuit
25. Apple's Tim Cook: Our personal data is 'weaponized against us' by you-know-who
26. US government medical website was hacked that 75,000 personal data was stolen
27. Pocket iNet ISP exposed 73GB of data including secret keys, plain text passwords
28. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
29. Phishing for knowledge
30. US Department of Defense Expands Bug Bounty Efforts
31. Join us, and @SentinelOne Nov 29, as we discuss fast acting #ransomware remediation, threat hunting, and #AI that stops incongruous
32. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
33. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
34. ISP Provider Exposed 73 Gigabytes of Highly Sensitive Data Including To The Internet
35. South Korea Seems Chief Target of the ‘Operation Oceansalt’ Campaign
36. Survey: Nearly Half of U.S. Adults Experienced a Data Breach in the Past Three Years
37. China asks blockchain-based service providers to control user information

SOUTH AMERICA

38. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
39. Phishing for knowledge

EUROPE

40. Hacker Guccifer, who exposed Clinton private email server, ready for US prison sentence
41. Magecart hackers change tactic and target vulnerable Magento extensions
42. Russia Behind Triton Malware? A Cybersecurity Consulting Firm Confirms
43. Supermarket told it must compensate 100,000 workers after payroll data deliberately leaked by rogue employee
44. New Malware Targets Industrial Control Systems
45. Yahoo to pay up to $85m to settle data breach lawsuit
46. Russian Malware Used In An Attempt To Sabotage Saudi Petrol Plant
47. Malware Targeting Brazil Uses Legitimate Windows Components WMI and CertUtil as Part of its Routine
48. "The resurgence of #VPNFilter #botnet appears to be limited to the Ukraine, but given the ease of infecting targeted systems,
49. Morrisons supermarket: We're taking payroll leak liability fight to UK Supreme Court
50. Weekly Threat Briefing: HealthCare.gov Suffered Data Breach As Hackers Stole 75,000 Records
51. Phishing for knowledge
52. Magecart Attackers Exploit Magento Zero-Days
53. Deadly Malware That Attacked Saudi Industrial Plant Came From Russia
54. Researchers: Russia is the initiator of ICS Attack Framework “TRITON” and Trisis
55. Russian Government-owned research institute linked to Triton attacks
56. FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware
57. Marine diesel engines software developed by Auto Maskin has serious vulnerabilities

AFRICA

58. Phishing for knowledge