Sector brief for 2018-10-29

HEALTHCARE

1. Hackers Breach System of Healthcare.Gov Exposing Personal Data of 75,000 Users
2. Beware! Downloader Malware Disguised as Game Apps Found On Google Play with More Than 51,100 Installations

TRANSPORT

3. What can we do to tackle today’s phishing epidemic?

BANKING & FINANCE

4. Future Investment Initiative Conference Website, Defaced, Now Restored
5. Here's how to defend your enterprise from Magecart
6. Breaking News: Securonix Threat Research: British Airways Breach
7. Cathay Pacific Suffers World’s Largest Airline Data Breach
8. sLoad and Ramnit Campaign Against UK and Italy
9. Cobalt Gang targets banks and financial service providers by sneaking PDFs past staff
10. Girl Scouts Alerted to Possible Data Breach
11. 'Narwhal Spider' group's spam campaign targets Japanese recipients with URLZone malware
12. What can we do to tackle today’s phishing epidemic?
13. The Worst Data Breach till Now 2018, and What It Means
14. Same Old yet Brand-new: New File Types Emerge in Malware Spam Attachments
15. Revolutionary Blockchain 3.0 Under CSE Platform

INFORMATION & TELECOMMUNICATION

16. SandboxEscaper expert is back and disclosed a new Windows Zero-Day
17. Word documents seemingly carrying videos can deliver malicious code instead
18. Remote Denial of Service Vulnerability Patched in Squid Proxy Cache Server
19. This is getting worse and worse. And is going to normalize and lead to much more successful phishing through SMS
20. Malware That Accompanies Google Chrome Download Detected
21. Systemd flaw could cause the crash or hijack of vulnerable Linux machines
22. What can we do to tackle today’s phishing epidemic?
23. Rise of the Bots
24. The Worst Data Breach till Now 2018, and What It Means
25. Same Old yet Brand-new: New File Types Emerge in Malware Spam Attachments
26. Crooks continue to abuse exposed Docker APIs for Cryptojacking
27. Have you ever wondered why #ransomware attacks happen on the Friday before a long weekend? We've teamed up with @SentinelOne
28. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy | Read the details here:

FOOD

Nil

WATER

29. Same Old yet Brand-new: New File Types Emerge in Malware Spam Attachments

ENERGY

30. Revolutionary Blockchain 3.0 Under CSE Platform

GOVERNMENT & PUBLIC SERVICE

31. Pentagon’s big audit will inspect for cybersecurity flaws, comptroller says
32. Hackers Breach System of Healthcare.Gov Exposing Personal Data of 75,000 Users

Daily brief for 2018-10-29

ASIA

1. Future Investment Initiative Conference Website, Defaced, Now Restored
2. Cathay Pacific Suffers World’s Largest Airline Data Breach
3. Serious Vulnerability Discovered In X.Org Server Affects Major Linux and BSD Variants
4. 'Narwhal Spider' group's spam campaign targets Japanese recipients with URLZone malware
5. Same Old yet Brand-new: New File Types Emerge in Malware Spam Attachments
6. Revolutionary Blockchain 3.0 Under CSE Platform
7. Leaked: iOS 12.1 will be released on October 30th

WORLD

8. Phishing spikes as private health continues to be most breached sector in Australia
9. Future Investment Initiative Conference Website, Defaced, Now Restored
10. Here's how to defend your enterprise from Magecart
11. Breaking News: Securonix Threat Research: British Airways Breach
12. Cathay Pacific Suffers World’s Largest Airline Data Breach
13. sLoad and Ramnit Campaign Against UK and Italy
14. Magecart Exploits Zero Day Vulnerabilities
15. Understanding mass data fragmentation
16. Secret Service Confirms Focus on Email Compromise Cybercrimes Worth $12 Billion
17. Man Ordered to Pay $8.6 Million for Launching DDoS Attacks against Rutgers University
18. Security Vulnerability in Internet-Connected Construction Cranes
19. Girl Scouts Alerted to Possible Data Breach
20. What can we do to tackle today’s phishing epidemic?
21. Privacy concerns cooling #InternetOfThings adoption in US & Europe, with consumers concerned about #DataLeaks, malware and product security (via @FSecure)
22. Das Geschäft mit gestohlenen Login-Daten von Privatnutzern und Unternehmensanwendern boomt. US-Journalist Brian Krebs beziffert die "Ausbeute" bei mehreren 100.000 US-Dollar
23. The Worst Data Breach till Now 2018, and What It Means
24. Same Old yet Brand-new: New File Types Emerge in Malware Spam Attachments
25. Cisco patched a command injection vulnerability in Webex Meetings
26. Leaked: iOS 12.1 will be released on October 30th

ATTACKS

27. Phishing spikes as private health continues to be most breached sector in Australia
28. Girl Scouts Issues Data Breach Warning to 2,800 Members
29. Nation-State Phishing: A Country-Sized Catch
30. A new phishing report reveals Microsoft, Paypal, and Netflix are among the top brands impersonated by phishing attacks. Attackers tend to
31. This is getting worse and worse. And is going to normalize and lead to much more successful phishing through SMS
32. Cathay Pacific Suffers World’s Largest Airline Data Breach
33. League of Legends Gamers Targeted by Phishing Scam | Avast
34. sLoad and Ramnit Campaign Against UK and Italy
35. Secret Service Confirms Focus on Email Compromise Cybercrimes Worth $12 Billion
36. Girl Scouts Alerted to Possible Data Breach
37. 'Narwhal Spider' group's spam campaign targets Japanese recipients with URLZone malware
38. DDoS and ransomware tools for starter and experienced cybercriminals exposed
39. Biggest Manufacturing Data Breaches of the 21st Century
40. What can we do to tackle today’s phishing epidemic?
41. Das Geschäft mit gestohlenen Login-Daten von Privatnutzern und Unternehmensanwendern boomt. US-Journalist Brian Krebs beziffert die "Ausbeute" bei mehreren 100.000 US-Dollar
42. The Worst Data Breach till Now 2018, and What It Means
43. Crooks continue to abuse exposed Docker APIs for Cryptojacking
44. IoT users uncertain if personal data is shared across multiple devices
45. 19% still save their password on a piece of paper
46. Hackers Breach System of Healthcare.Gov Exposing Personal Data of 75,000 Users
47. Hackers steal personal data of up to 9.4 million Cathay Pacific passengers
48. Leaked: iOS 12.1 will be released on October 30th
49. Vulnerability In Microsoft Word Online Video Feature Allows for Phishing
50. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy | Read the details here:

THREATS

51. Videos and MS Office documents - ingredients for a malware attack
52. SandboxEscaper expert is back and disclosed a new Windows Zero-Day
53. IoT Flaw Allows Hijacking of Connected Construction Cranes
54. Mac CryptoCurrency Price Tracker Caught Installing Backdoors
55. Mac cryptocurrency ticker app installs backdoors
56. Word documents seemingly carrying videos can deliver malicious code instead
57. Remote Denial of Service Vulnerability Patched in Squid Proxy Cache Server
58. X.Org Flaw Allows Privilege Escalation in Linux Systems
59. Downloading Google Chrome via Microsoft Edge Endangered by Malware
60. The Ransomware Attack on a North Carolina Water Utility May Not Have Been What it Seemed
61. X.Org Flaw Exposes Unix-Like OSes to Attacks
62. Windows 10 UWP Bug Could Give Malicious Devs Access To All Your Files
63. X.org Bug Bites OpenBSD And Other Big Operating Systems
64. If your company uses Windows 10, watch out: there are new vulnerabilities about
65. Advanced Malware Protection Affected by Bug That Can Inhibit Intrusion Detection
66. Logical Bug in Microsoft Word's 'Online Video' Allows Code Execution
67. Call of Duty players caught up in cryptocurrency theft racket
68. Ransomware and the enterprise: A new white paper
69. Windows 10 UWP bug could give malicious devs access to all your files
70. Windows 10 Bug Allowed UWP Apps Full Access to File System
71. Magecart Exploits Zero Day Vulnerabilities
72. Serious Vulnerability Discovered In X.Org Server Affects Major Linux and BSD Variants
73. Malware That Accompanies Google Chrome Download Detected
74. Security Vulnerability in Internet-Connected Construction Cranes
75. 'Narwhal Spider' group's spam campaign targets Japanese recipients with URLZone malware
76. Cyber-criminals exploit misconfigured container to deliver cryptominer
77. DDoS and ransomware tools for starter and experienced cybercriminals exposed
78. Systemd flaw could cause the crash or hijack of vulnerable Linux machines
79. Pentagon’s big audit will inspect for cybersecurity flaws, comptroller says
80. Vulnerability found in Sophos anti-malware product
81. Flaws in brain stimulation tech could let hackers erase or hold memories for ransom
82. Privacy concerns cooling #InternetOfThings adoption in US & Europe, with consumers concerned about #DataLeaks, malware and product security (via @FSecure)
83. Same Old yet Brand-new: New File Types Emerge in Malware Spam Attachments
84. Crooks continue to abuse exposed Docker APIs for Cryptojacking
85. Revolutionary Blockchain 3.0 Under CSE Platform
86. #Antivirus SW alone can't stop new #malware or #ransomware. by @MariaKorolov -
87. Beware! Downloader Malware Disguised as Game Apps Found On Google Play with More Than 51,100 Installations
88. Cisco patched a command injection vulnerability in Webex Meetings
89. Have you ever wondered why #ransomware attacks happen on the Friday before a long weekend? We've teamed up with @SentinelOne
90. Microsoft Bing Delivered Dangerous Malware When You Try to Download Google Chrome
91. Vulnerability In Microsoft Word Online Video Feature Allows for Phishing

CRIME

92. Future Investment Initiative Conference Website, Defaced, Now Restored
93. Here's how to defend your enterprise from Magecart
94. Breaking News: Securonix Threat Research: British Airways Breach
95. Mirai Botnet Operator Ordered to Pay $8.6 Million
96. Cathay Pacific Suffers World’s Largest Airline Data Breach
97. Call of Duty players caught up in cryptocurrency theft racket
98. League of Legends Gamers Targeted by Phishing Scam | Avast
99. Malware That Accompanies Google Chrome Download Detected
100. Secret Service Confirms Focus on Email Compromise Cybercrimes Worth $12 Billion
101. Man Ordered to Pay $8.6 Million for Launching DDoS Attacks against Rutgers University
102. Girl Scouts Alerted to Possible Data Breach
103. Mirai Author Gets House Arrest for DDoS Attacks on University
104. DDoS and ransomware tools for starter and experienced cybercriminals exposed
105. What can we do to tackle today’s phishing epidemic?
106. Revolutionary Blockchain 3.0 Under CSE Platform
107. 33,000 Accounting Inbox Credentials Exposed Online: BEC Made Easy | Read the details here:

POLITICS

108. Future Investment Initiative Conference Website, Defaced, Now Restored
109. Secret Service Confirms Focus on Email Compromise Cybercrimes Worth $12 Billion
110. What can we do to tackle today’s phishing epidemic?

APT report for 2018-10-28

TRANSNATIONAL / UNKNOWN

1. Security Affairs newsletter Round 186 – News of the week

CHINA

Nil

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

2. Russian Research Lab Involved in the Development of TRITON Malware, Says FireEye

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-10-28

WINDOWS

1. Security Affairs newsletter Round 186 – News of the week
2. How to deliver malware using weaponized Microsoft Office docs embedding YouTube video
3. Critical Code Execution Vulnerability Found in MKVToolNix Tools that Parses MKV Files

LINUX

4. Security Affairs newsletter Round 186 – News of the week
5. Critical Code Execution Vulnerability Found in MKVToolNix Tools that Parses MKV Files

UNIX

Nil

ANDROID

6. Security Affairs newsletter Round 186 – News of the week

IOS

7. Apple Made Apology Due to Apple ID Phishing Attacks

MACOS

8. Apple Made Apology Due to Apple ID Phishing Attacks

Threat report for 2018-10-28

DATA BREACH & DATA LOSS

1. Consulting Firm Leaked Data Of Democratic Party Fundraisers In Unsecured NAS Device
2. Yahoo To Pay $50M, Other Costs For Massive Data Breach
3. A recent @HealthCareGov #breach exposed unknown types of data on 75,000 people, but a lack of information in the disclosure
4. "If an organization created #DMARC records for the first time, it would encounter syntax and content issues -- one of
5. The #NetSpectre vulnerability could enable a slow leak of data remotely via side channels. Expert Michael Cobb of @thehairyITdog explains

DENIAL-OF-SERVICE

Nil

MALVERTISING

Nil

PHISHING

6. Apple Made Apology Due to Apple ID Phishing Attacks
7. On Phishing Attacks and the Companies That are Targeted the Most

WEB DEFACEMENT

Nil

BOTNET

8. Satori botnet author in jail again after breaking pretrial release conditions
9. After an attempted comeback by the Russian built #VPNFilter #botnet, home #networkdevices are at risk. Learn how this #malware targets

RANSOMWARE

10. New ShadowTalk is out! @TheHVanRiper and Rafael Amado join @mazzazone to discuss #ransomware surges in October, Cathay Pacific Breach, and

CRYPTOMINING & CRYPTOCURRENCIES

11. Is blockchain a solution to IoT security problems?

MALWARE

12. 12 Malicious Python Libraries Found And Removed From PyPi
13. Russian Research Lab Involved in the Development of TRITON Malware, Says FireEye
14. How to deliver malware using weaponized Microsoft Office docs embedding YouTube video
15. After an attempted comeback by the Russian built #VPNFilter #botnet, home #networkdevices are at risk. Learn how this #malware targets
16. Bingo. Investigators find the same remote access trojan deployed to several other machines. Now the responders know what to look for.
17. "My name is Mikko and I've been working with viruses and malware all my freaking life."

EXPLOIT

Nil

VULNERABILITY

18. Cisco Patched Privilege Escalation Vulnerability In Webex Meetings Desktop App
19. A flaw in @Cisco Webex -- called WebExec -- can allow #RemoteCodeExecution. And while experts don't agree on how dangerous
20. .@Siemens central plant clocks were affected by six SICLOCK flaws, three have been rated "critical." Learn what these SICLOCK flaws
21. The #NetSpectre vulnerability could enable a slow leak of data remotely via side channels. Expert Michael Cobb of @thehairyITdog explains
22. Critical Code Execution Vulnerability Found in MKVToolNix Tools that Parses MKV Files

Region brief for 2018-10-28

ASIA

1. Apple Made Apology Due to Apple ID Phishing Attacks
2. Security Affairs newsletter Round 186 – News of the week
3. Russian Research Lab Involved in the Development of TRITON Malware, Says FireEye

OCEANIA

Nil

NORTH AMERICA

4. Consulting Firm Leaked Data Of Democratic Party Fundraisers In Unsecured NAS Device
5. On Phishing Attacks and the Companies That are Targeted the Most
6. New ShadowTalk is out! @TheHVanRiper and Rafael Amado join @mazzazone to discuss #ransomware surges in October, Cathay Pacific Breach, and

SOUTH AMERICA

Nil

EUROPE

7. Security Affairs newsletter Round 186 – News of the week
8. Russian Research Lab Involved in the Development of TRITON Malware, Says FireEye
9. New ShadowTalk is out! @TheHVanRiper and Rafael Amado join @mazzazone to discuss #ransomware surges in October, Cathay Pacific Breach, and
10. After an attempted comeback by the Russian built #VPNFilter #botnet, home #networkdevices are at risk. Learn how this #malware targets

AFRICA

Nil

Sector brief for 2018-10-28

HEALTHCARE

1. Security Affairs newsletter Round 186 – News of the week

TRANSPORT

Nil

BANKING & FINANCE

2. Apple Made Apology Due to Apple ID Phishing Attacks
3. On Phishing Attacks and the Companies That are Targeted the Most

INFORMATION & TELECOMMUNICATION

4. Apple Made Apology Due to Apple ID Phishing Attacks
5. On Phishing Attacks and the Companies That are Targeted the Most
6. Security Affairs newsletter Round 186 – News of the week
7. How to deliver malware using weaponized Microsoft Office docs embedding YouTube video
8. "My name is Mikko and I've been working with viruses and malware all my freaking life."

FOOD

Nil

WATER

Nil

ENERGY

Nil

GOVERNMENT & PUBLIC SERVICE

9. Consulting Firm Leaked Data Of Democratic Party Fundraisers In Unsecured NAS Device
10. Security Affairs newsletter Round 186 – News of the week
11. Russian Research Lab Involved in the Development of TRITON Malware, Says FireEye

Daily brief for 2018-10-28

ASIA

1. Apple Made Apology Due to Apple ID Phishing Attacks
2. Security Affairs newsletter Round 186 – News of the week
3. Russian Research Lab Involved in the Development of TRITON Malware, Says FireEye

WORLD

4. Consulting Firm Leaked Data Of Democratic Party Fundraisers In Unsecured NAS Device
5. On Phishing Attacks and the Companies That are Targeted the Most
6. Security Affairs newsletter Round 186 – News of the week
7. Russian Research Lab Involved in the Development of TRITON Malware, Says FireEye
8. New ShadowTalk is out! @TheHVanRiper and Rafael Amado join @mazzazone to discuss #ransomware surges in October, Cathay Pacific Breach, and
9. After an attempted comeback by the Russian built #VPNFilter #botnet, home #networkdevices are at risk. Learn how this #malware targets

ATTACKS

10. Consulting Firm Leaked Data Of Democratic Party Fundraisers In Unsecured NAS Device
11. Apple Made Apology Due to Apple ID Phishing Attacks
12. On Phishing Attacks and the Companies That are Targeted the Most
13. Yahoo To Pay $50M, Other Costs For Massive Data Breach
14. A recent @HealthCareGov #breach exposed unknown types of data on 75,000 people, but a lack of information in the disclosure
15. "If an organization created #DMARC records for the first time, it would encounter syntax and content issues -- one of
16. The #NetSpectre vulnerability could enable a slow leak of data remotely via side channels. Expert Michael Cobb of @thehairyITdog explains

THREATS

17. Is blockchain a solution to IoT security problems?
18. Cisco Patched Privilege Escalation Vulnerability In Webex Meetings Desktop App
19. A flaw in @Cisco Webex -- called WebExec -- can allow #RemoteCodeExecution. And while experts don't agree on how dangerous
20. 12 Malicious Python Libraries Found And Removed From PyPi
21. Russian Research Lab Involved in the Development of TRITON Malware, Says FireEye
22. .@Siemens central plant clocks were affected by six SICLOCK flaws, three have been rated "critical." Learn what these SICLOCK flaws
23. How to deliver malware using weaponized Microsoft Office docs embedding YouTube video
24. New ShadowTalk is out! @TheHVanRiper and Rafael Amado join @mazzazone to discuss #ransomware surges in October, Cathay Pacific Breach, and
25. The #NetSpectre vulnerability could enable a slow leak of data remotely via side channels. Expert Michael Cobb of @thehairyITdog explains
26. Critical Code Execution Vulnerability Found in MKVToolNix Tools that Parses MKV Files
27. After an attempted comeback by the Russian built #VPNFilter #botnet, home #networkdevices are at risk. Learn how this #malware targets
28. Bingo. Investigators find the same remote access trojan deployed to several other machines. Now the responders know what to look for.
29. "My name is Mikko and I've been working with viruses and malware all my freaking life."

CRIME

30. Apple Made Apology Due to Apple ID Phishing Attacks
31. On Phishing Attacks and the Companies That are Targeted the Most
32. Security Affairs newsletter Round 186 – News of the week

POLITICS

33. Security Affairs newsletter Round 186 – News of the week

APT report for 2018-10-27

TRANSNATIONAL / UNKNOWN

Nil

CHINA

Nil

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

Nil

SERBIA

Nil

UKRAINE

1. News of the Week: October 27, 2018

Platform report for 2018-10-27

WINDOWS

1. Cisco launches patches for vulnerabilities in WEBEX Meetings app

LINUX

2. The LibSSH Security Bug in the Nutshell

UNIX

Nil

ANDROID

3. The LibSSH Security Bug in the Nutshell

IOS

4. The LibSSH Security Bug in the Nutshell

MACOS

5. The LibSSH Security Bug in the Nutshell

Threat report for 2018-10-27

DATA BREACH & DATA LOSS

Nil

DENIAL-OF-SERVICE

1. DDoS and Ransomware Tools Used by Cyber Criminals Discovered
2. A few dollars to bring down sites with new Bushido-based DDoS-for-hire service
3. Hackers Offering DDoS-for-Hire Service Powered by Bushido Botnet in Dark Web Markets

MALVERTISING

Nil

PHISHING

Nil

WEB DEFACEMENT

Nil

BOTNET

4. Hackers Offering DDoS-for-Hire Service Powered by Bushido Botnet in Dark Web Markets

RANSOMWARE

5. DDoS and Ransomware Tools Used by Cyber Criminals Discovered
6. Decrypt files attacked with the latest versions of GandCrab ransomware

CRYPTOMINING & CRYPTOCURRENCIES

7. Sorry friends, I'm afraid I just can't quite afford the Bitcoin to stop that vid from leaking everywhere
8. Australian Cryptocurrency Theft Highlights Security Mistakes

MALWARE

9. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
10. Bankbot/Anubis downloader hits #1 trending at finance @ThreatFabric @
11. Twelve malicious Python libraries found and removed from PyPI
12. The forensics analysts log the adversaries’ actions and every network packet the hackers send. The adversaries use a process running
13. Executable Formats and How To Exploit Them
14. Unpatched Critical Bug in Microsoft Word Online Video Feature Allow Attacker to Deliver Powerful Malware
15. New malware attacks targeting voters in key states in the 2018 US midterm elections
16. Two hours after the deadline, the forensics team notices someone accessing the MES system server using domain administrator credentials through

EXPLOIT

17. Executable Formats and How To Exploit Them

VULNERABILITY

18. Researchers recently found vulnerabilities within the robot controllers from @Universal_Robot. Learn what these #robot controllers are used for and how
19. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
20. The LibSSH Security Bug in the Nutshell
21. The Pentagon expands the scope of its vulnerability bounty program
22. Unpatched Critical Bug in Microsoft Word Online Video Feature Allow Attacker to Deliver Powerful Malware
23. Cisco launches patches for vulnerabilities in WEBEX Meetings app
24. A #RemoteCodeExecution flaw in @Cisco Webex -- called WebExec -- could be an easy vector for insider attacks, and the

Region brief for 2018-10-27

ASIA

1. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia

OCEANIA

2. Australian Cryptocurrency Theft Highlights Security Mistakes

NORTH AMERICA

3. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
4. Australian Cryptocurrency Theft Highlights Security Mistakes
5. The Pentagon expands the scope of its vulnerability bounty program
6. Decrypt files attacked with the latest versions of GandCrab ransomware
7. New malware attacks targeting voters in key states in the 2018 US midterm elections

SOUTH AMERICA

Nil

EUROPE

8. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
9. Decrypt files attacked with the latest versions of GandCrab ransomware
10. New malware attacks targeting voters in key states in the 2018 US midterm elections

AFRICA

Nil

Sector brief for 2018-10-27

HEALTHCARE

Nil

TRANSPORT

1. A few dollars to bring down sites with new Bushido-based DDoS-for-hire service

BANKING & FINANCE

2. News of the Week: October 27, 2018
3. Australian Cryptocurrency Theft Highlights Security Mistakes
4. Bankbot/Anubis downloader hits #1 trending at finance @ThreatFabric @
5. The Pentagon expands the scope of its vulnerability bounty program

INFORMATION & TELECOMMUNICATION

6. A few dollars to bring down sites with new Bushido-based DDoS-for-hire service
7. Bankbot/Anubis downloader hits #1 trending at finance @ThreatFabric @
8. The LibSSH Security Bug in the Nutshell

FOOD

Nil

WATER

Nil

ENERGY

Nil

GOVERNMENT & PUBLIC SERVICE

9. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
10. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
11. Australian Cryptocurrency Theft Highlights Security Mistakes
12. The Pentagon expands the scope of its vulnerability bounty program
13. Decrypt files attacked with the latest versions of GandCrab ransomware
14. New malware attacks targeting voters in key states in the 2018 US midterm elections

Daily brief for 2018-10-27

ASIA

1. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia

WORLD

2. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
3. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
4. Australian Cryptocurrency Theft Highlights Security Mistakes
5. The Pentagon expands the scope of its vulnerability bounty program
6. Decrypt files attacked with the latest versions of GandCrab ransomware
7. New malware attacks targeting voters in key states in the 2018 US midterm elections

ATTACKS

Nil

THREATS

8. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
9. DDoS and Ransomware Tools Used by Cyber Criminals Discovered
10. Researchers recently found vulnerabilities within the robot controllers from @Universal_Robot. Learn what these #robot controllers are used for and how
11. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
12. Sorry friends, I'm afraid I just can't quite afford the Bitcoin to stop that vid from leaking everywhere
13. Australian Cryptocurrency Theft Highlights Security Mistakes
14. Bankbot/Anubis downloader hits #1 trending at finance @ThreatFabric @
15. Twelve malicious Python libraries found and removed from PyPI
16. The forensics analysts log the adversaries’ actions and every network packet the hackers send. The adversaries use a process running
17. The LibSSH Security Bug in the Nutshell
18. Executable Formats and How To Exploit Them
19. The Pentagon expands the scope of its vulnerability bounty program
20. Decrypt files attacked with the latest versions of GandCrab ransomware
21. Unpatched Critical Bug in Microsoft Word Online Video Feature Allow Attacker to Deliver Powerful Malware
22. Cisco launches patches for vulnerabilities in WEBEX Meetings app
23. New malware attacks targeting voters in key states in the 2018 US midterm elections
24. Two hours after the deadline, the forensics team notices someone accessing the MES system server using domain administrator credentials through
25. A #RemoteCodeExecution flaw in @Cisco Webex -- called WebExec -- could be an easy vector for insider attacks, and the

CRIME

26. DDoS and Ransomware Tools Used by Cyber Criminals Discovered
27. Australian Cryptocurrency Theft Highlights Security Mistakes
28. Hackers Offering DDoS-for-Hire Service Powered by Bushido Botnet in Dark Web Markets

POLITICS

Nil

APT report for 2018-10-26

TRANSNATIONAL / UNKNOWN

1. British Airways: additional 185,000 passengers may have been affected
2. BA Website Hijacked by Magecart. Again. | Avast
3. US Counters Russian Influence & Magecart Hacks Magento | Avast
4. BA website and data breach by Magecart deeper than first thought
5. BA Breach: An Extra 185K Customers Notified
6. Hackers attack Cathay Pacific
7. Second attack against British Airways is disclosed

CHINA

8. Tracking Tick Through Recent Campaigns Targeting East Asia
9. Operation Oceansalt

INDIA

Nil

NORTH KOREA

10. North Korea Backed Two Cryptocurrency Scams This Year, Says Report

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

11. GreyEnergy cyberespionage group targets Poland and Ukraine
12. Russian sabotage in Saudi petrochemicals

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-10-26

WINDOWS

1. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
2. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset
3. ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping
4. Cisco patches command injection bug in Webex Meetings Desktop App for Windows
5. Vulnerability Spotlight: Talos-2018-0694 - MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
6. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data
7. Zero-day vulnerability in Windows allows privileges escalation

LINUX

8. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
9. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset
10. ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping
11. Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems
12. Chalubo Botnet
13. CVE-2018-14665: Xorg X Server privilege escalation vulnerabilities
14. This two-year-old X.org give-me-root hole is so trivial to exploit, you can fit it in a single tweet
15. Vulnerability Spotlight: Talos-2018-0694 - MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
16. New Privilege Escalation Flaw Affects Most Linux Distributions

UNIX

17. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
18. CVE-2018-14665: Xorg X Server privilege escalation vulnerabilities
19. New Privilege Escalation Flaw Affects Most Linux Distributions

ANDROID

Nil

IOS

Nil

MACOS

20. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset

Threat report for 2018-10-26

DATA BREACH & DATA LOSS

1. ThreatList: 1 Out of 5 Would Ditch a Business After a Data Breach
2. Facebook removes Iranian influence campaign as midterms near
3. Bushido-Powered DDoS Service Whipped Up from Leaked Code
4. British Airways: 185K Affected in Second Data Breach
5. British Airways Data Breach Takes Off Again with 185K More Victims
6. Settlement in Yahoo data breach leaves company to pay $50M
7. Pocket iNET ISP Exposed 73GB of Sensitive Data On Misconfigured S3 Bucket
8. Campaign 2018: New malware attacks target voters in key battleground states
9. Cathay Pacific Hacked, Personal Data For 9.4 Million Passengers Compromised
10. Tracking Tick Through Recent Campaigns Targeting East Asia
11. Details of 9mil compromised in Cathay Pacific data leak
12. Cathay Pacific Suffered Data Breach Affecting 9.4 Million Customers
13. BA website and data breach by Magecart deeper than first thought
14. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
15. Cathay Pacific hack: Personal data of up to 9.4 million airline passengers laid bare
16. Cathay Pacific Says 9.4 Million Affected by Data Breach
17. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may
18. Airline Discovers Trove of Frequent Flyer Accounts Compromised and Posted for Sale Online:
19. British Airways data breach worse than thought
20. Spammers Behind Historic Data Breach Affecting Millions of Facebook Users
21. Cathay Pacific Airways Confirm Data Breach of its Customers
22. “Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
23. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data

DENIAL-OF-SERVICE

24. University DDoS attack leads to $8.6 million fine, house arrest for New Jersey man
25. Bushido-Powered DDoS Service Whipped Up from Leaked Code
26. 16K Strong DDoS-for-Hire Botnet Provides 420+ GB/s Club to Knock Out Websites
27. DemonBot Fans DDoS Flames with Hadoop Enslavement
28. New DemonBot Attack Hadoop Clusters to Performing DDoS Attacks using Powerful Cloud infrastructure servers

MALVERTISING

Nil

PHISHING

29. Microsoft bug makes phishing easy, says cybersecurity firm
30. PhishX –Spear Phishing Tool for Capturing Credentials
31. “Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with

WEB DEFACEMENT

Nil

BOTNET

32. Exploits Block List Grows 50% Because of Spambot, Avalanche/Gamarue botnet
33. 16K Strong DDoS-for-Hire Botnet Provides 420+ GB/s Club to Knock Out Websites
34. Chalubo Botnet
35. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
36. New DemonBot Botnet Pulls the YARN in Hadoop Servers

RANSOMWARE

37. The Week in Ransomware - October 26th 2018 - Decryptors, RaaS, and More
38. 3 Keys to Reducing the Threat of Ransomware

CRYPTOMINING & CRYPTOCURRENCIES

39. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
40. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
41. North Korea regime using and exploiting cryptocurrencies
42. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
43. No Place for Security as Cryptocurrency Skills Demand Soars
44. What Is Gridcoin and How Can It Advance Science?
45. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
46. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
47. How to become a Monero million(th)aire in just 20 minutes [PODCAST]

MALWARE

48. Due to Misconfigured Component: DemonBot Malware Infects Multiple Apache Hadoop Servers
49. PoC Attack Leverages Microsoft Office and YouTube to Deliver Malware
50. ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping
51. Scammers use old browser trick to create fake virus download
52. Campaign 2018: New malware attacks target voters in key battleground states
53. DeepPhish: Simulating Malicious AI to Act Like an Adversary
54. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
55. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
56. An innovative partnership could help Cyber Command fight malware
57. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data

EXPLOIT

58. This two-year-old X.org give-me-root hole is so trivial to exploit, you can fit it in a single tweet

VULNERABILITY

59. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
60. Cloudflare WAF Bypass Vulnerability Discovered
61. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset
62. Vulnerability Spotlight: Talos-2018-0694 – MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
63. Microsoft bug makes phishing easy, says cybersecurity firm
64. A flaw in @Cisco Webex -- called WebExec -- can allow #RemoteCodeExecution. And while experts don't agree on how dangerous
65. Pentagon Expands Bug Bounty To Include Physical Systems
66. WebExec vulnerability leaves Webex open to insider attacks
67. Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems
68. Researchers discovered a vulnerability in Cisco #Webex, called #WebExec, which allows local attackers to issue commands as privileged users. @iagox86
69. Cisco patches command injection bug in Webex Meetings Desktop App for Windows
70. CVE-2018-9206 was maliciously exploited that multiple websites were linked to the search page to jump to the betting site
71. CVE-2018-14665: Xorg X Server privilege escalation vulnerabilities
72. What a crane in the ass: Bug leaves construction machinery vulnerable to evil command injection
73. Researchers report vulnerability in Microsoft Word's online video feature
74. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may
75. Vulnerability Spotlight: Talos-2018-0694 - MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
76. LIVE NETWORKS LIVE555 Streaming Media RTSP Server Remote Code Execution Vulnerability(CVE-2018-4013) Threat Alert
77. New Privilege Escalation Flaw Affects Most Linux Distributions
78. Top 5 Application Vulnerabilities: How to Prevent Risks
79. 7 places to find threat intel beyond vulnerability databases
80. Zero-day vulnerability in Windows allows privileges escalation

Region brief for 2018-10-26

ASIA

1. GreyEnergy cyberespionage group targets Poland and Ukraine
2. Facebook removes Iranian influence campaign as midterms near
3. Exploits Block List Grows 50% Because of Spambot, Avalanche/Gamarue botnet
4. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
5. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
6. Tracking Tick Through Recent Campaigns Targeting East Asia
7. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
8. North Korea regime using and exploiting cryptocurrencies
9. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
10. LIVE NETWORKS LIVE555 Streaming Media RTSP Server Remote Code Execution Vulnerability(CVE-2018-4013) Threat Alert
11. New Privilege Escalation Flaw Affects Most Linux Distributions
12. Operation Oceansalt
13. Hackers attack Cathay Pacific
14. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
15. Russian sabotage in Saudi petrochemicals

OCEANIA

16. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
17. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency

NORTH AMERICA

18. University DDoS attack leads to $8.6 million fine, house arrest for New Jersey man
19. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
20. US Counters Russian Influence & Magecart Hacks Magento | Avast
21. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
22. What a crane in the ass: Bug leaves construction machinery vulnerable to evil command injection
23. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets

SOUTH AMERICA

Nil

EUROPE

24. British Airways: additional 185,000 passengers may have been affected
25. GreyEnergy cyberespionage group targets Poland and Ukraine
26. British Airways: 185K Affected in Second Data Breach
27. BA Website Hijacked by Magecart. Again. | Avast
28. British Airways Data Breach Takes Off Again with 185K More Victims
29. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
30. US Counters Russian Influence & Magecart Hacks Magento | Avast
31. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
32. BA website and data breach by Magecart deeper than first thought
33. No Place for Security as Cryptocurrency Skills Demand Soars
34. BA Breach: An Extra 185K Customers Notified
35. British Airways data breach worse than thought
36. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
37. Hackers attack Cathay Pacific
38. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
39. Second attack against British Airways is disclosed
40. Russian sabotage in Saudi petrochemicals

AFRICA

Nil