Daily brief for 2018-11-02

ASIA

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Stuxnet Returns, Striking Iran with New Variant
3. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
4. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
5. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
6. Iran has become victim of a cyberattack campaign
7. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

WORLD

8. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
9. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
10. Magecart cybergang targeting e-commerce credit card data
11. New Data Affirms Cyber Threat for Industrial Control Systems
12. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
13. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
14. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
15. SMS Phishing + Cardless ATM = Profit
16. Stuxnet Returns, Striking Iran with New Variant
17. Bluetooth Bugs Speak to Lack of Security in DevOps
18. Sauter Quickly Patches Flaw in Building Automation Software
19. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
20. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
21. Beware this malware: it can even survive operating systems being reinstalled
22. Magecart claims fresh victim in electronics kit seller Kitronik
23. SamSam ransomware campaigns continue to target U.S. in 2018
24. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
25. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
26. U.S. Geological Survey Network got Infected with Malware
27. 85 million voter records on sale
28. Iran has become victim of a cyberattack campaign
29. EY launches the world's first secure private transactions over the Ethereum public blockchain

ATTACKS

30. Two botnets are fighting over control of thousands of unsecured Android devices
31. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
32. Spam campaign targets Exodus Mac Users
33. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
34. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
35. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
36. SMS Phishing + Cardless ATM = Profit
37. ePHI of 8,000 Patients Exposed in Health Plan Breach
38. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
39. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
40. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
41. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
42. How to password protect a folder or file in Windows | Avast
43. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
44. SamSam ransomware campaigns continue to target U.S. in 2018
45. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
46. Radisson Hotel Group Hit by Data Breach
47. Spam campaign targets Exodus Mac Users
48. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
49. Shipbuilder, defense contractor Austal reveals data breach
50. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
51. Data theft at Radisson Hotel Group
52. 85 million voter records on sale
53. Iran has become victim of a cyberattack campaign
54. YAPBS – Yet Another Password Breach Scam
55. Apache HBase 2.1.1 release, distributed database
56. FIFA admits hack and braces for new leaks

THREATS

57. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
58. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
59. ​The day computer security turned real: The Morris Worm turns 30
60. Worst Malware and Threat Actors of 2018
61. Cisco Security Appliance Zero-Day Found Actively Exploited in the Wild
62. New Ransomware using DiskCryptor With Custom Ransom Message
63. BLEEDINGBIT – Two Zero Day Vulnerabilities Affecting Wireless Access Point Bluetooth Chips
64. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
65. Hackers actively exploiting vulnerabilities in Cisco security appliances
66. Cisco fixed the high-risk security vulnerabilities in variant products
67. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
68. Bluetooth Bugs Speak to Lack of Security in DevOps
69. Sauter Quickly Patches Flaw in Building Automation Software
70. Bleedingbit vulnerabilities put Wi-Fi access points at risk
71. Adversaries Distribute Malware Via Rarely Used Extensions
72. Test IO introduces Bug Fix Confirmation, leveraging network of software testers to verify bug fixes
73. Can you spot a malicious email? Take the quiz at
74. Antimalware Day: The evolution of malicious code
75. Flaw in Sophos HitmanPro.Alert could enable hackers to gain privileges over systems
76. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
77. Intel CPUs impacted by new PortSmash side-channel vulnerability
78. Beware this malware: it can even survive operating systems being reinstalled
79. SamSam ransomware campaigns continue to target U.S. in 2018
80. CISCO warn of a zero-day DoS flaw that is being actively exploited in attacks
81. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes
82. .@ArmisSecurity researchers discovered two chip-level #Bluetooth vulnerabilities -- dubbed #Bleedingbit -- that could allow pseudo #RemoteCodeExecution on wireless access points.
83. Cisco Reports SIP Inspection Vulnerability
84. Kraken ransomware gets packaged into Fallout EK
85. Emotet Trojan Changes Tactics…Again
86. Mozilla exorcises five bugs on Halloween
87. Giant ransomware bundle threatens to make malware attacks easier for crooks
88. Blockwatch: The aeternity Blockchain
89. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
90. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
91. U.S. Geological Survey Network got Infected with Malware
92. Trading with cryptocurrencies without losing self control
93. EY launches the world's first secure private transactions over the Ethereum public blockchain
94. Search for “Installing Chrome” on Bing can lead to malicious content
95. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices
96. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers
97. GNOME 3.30.2 released: bugs fix
98. Attackers Use Zero-Day That Can Restart Cisco Security Appliances
99. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

CRIME

100. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
101. Magecart cybergang targeting e-commerce credit card data
102. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
103. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
104. SMS Phishing + Cardless ATM = Profit
105. Stuxnet Returns, Striking Iran with New Variant
106. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
107. How to password protect a folder or file in Windows | Avast
108. Beware this malware: it can even survive operating systems being reinstalled
109. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
110. Radisson Hotel Group Hit by Data Breach
111. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
112. Emotet Trojan Changes Tactics…Again
113. Shipbuilder, defense contractor Austal reveals data breach
114. Data theft at Radisson Hotel Group
115. 85 million voter records on sale
116. Iran has become victim of a cyberattack campaign
117. Trading with cryptocurrencies without losing self control
118. EY launches the world's first secure private transactions over the Ethereum public blockchain
119. YAPBS – Yet Another Password Breach Scam
120. FIFA admits hack and braces for new leaks

POLITICS

121. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
122. Spam campaign targets Exodus Mac Users
123. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
124. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
125. Beware this malware: it can even survive operating systems being reinstalled
126. Emotet Trojan Changes Tactics…Again
127. 85 million voter records on sale
128. Iran has become victim of a cyberattack campaign

APT report for 2018-11-02

TRANSNATIONAL / UNKNOWN

1. Magecart cybergang targeting e-commerce credit card data
2. Magecart claims fresh victim in electronics kit seller Kitronik

CHINA

3. Beware this malware: it can even survive operating systems being reinstalled

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

4. New Data Affirms Cyber Threat for Industrial Control Systems
5. Beware this malware: it can even survive operating systems being reinstalled

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-11-02

WINDOWS

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Spam campaign targets Exodus Mac Users
3. New Data Affirms Cyber Threat for Industrial Control Systems
4. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
5. How to password protect a folder or file in Windows | Avast
6. Beware this malware: it can even survive operating systems being reinstalled
7. Search for “Installing Chrome” on Bing can lead to malicious content

LINUX

8. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
9. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
10. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes

UNIX

Nil

ANDROID

11. Two botnets are fighting over control of thousands of unsecured Android devices
12. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities

IOS

Nil

MACOS

13. Spam campaign targets Exodus Mac Users
14. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures

Threat report for 2018-11-02

DATA BREACH & DATA LOSS

1. Two botnets are fighting over control of thousands of unsecured Android devices
2. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
3. Spam campaign targets Exodus Mac Users
4. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
5. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
6. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
7. ePHI of 8,000 Patients Exposed in Health Plan Breach
8. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
9. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
10. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
11. SamSam ransomware campaigns continue to target U.S. in 2018
12. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
13. Radisson Hotel Group Hit by Data Breach
14. Spam campaign targets Exodus Mac Users
15. Shipbuilder, defense contractor Austal reveals data breach
16. Data theft at Radisson Hotel Group
17. 85 million voter records on sale
18. Iran has become victim of a cyberattack campaign
19. Apache HBase 2.1.1 release, distributed database
20. FIFA admits hack and braces for new leaks

DENIAL-OF-SERVICE

21. ThreatList: Fewer Big DDoS Attacks in Q3, Overall Rate Holds Steady
22. Bushido Botnet and DDoS-for-Hire

MALVERTISING

Nil

PHISHING

23. SMS Phishing + Cardless ATM = Profit
24. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
25. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
26. How to password protect a folder or file in Windows | Avast
27. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
28. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
29. YAPBS – Yet Another Password Breach Scam

WEB DEFACEMENT

Nil

BOTNET

30. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
31. Bushido Botnet and DDoS-for-Hire
32. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
33. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
34. 'Outlaw' threat actor uses Shellbot variant to form new botnet

RANSOMWARE

35. New Ransomware using DiskCryptor With Custom Ransom Message
36. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
37. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
38. SamSam ransomware campaigns continue to target U.S. in 2018
39. Kraken ransomware gets packaged into Fallout EK
40. Giant ransomware bundle threatens to make malware attacks easier for crooks

CRYPTOMINING & CRYPTOCURRENCIES

41. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
42. Kraken ransomware gets packaged into Fallout EK
43. Blockwatch: The aeternity Blockchain
44. Trading with cryptocurrencies without losing self control
45. EY launches the world's first secure private transactions over the Ethereum public blockchain
46. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

MALWARE

47. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
48. ​The day computer security turned real: The Morris Worm turns 30
49. Worst Malware and Threat Actors of 2018
50. Adversaries Distribute Malware Via Rarely Used Extensions
51. Can you spot a malicious email? Take the quiz at
52. Antimalware Day: The evolution of malicious code
53. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
54. Beware this malware: it can even survive operating systems being reinstalled
55. Emotet Trojan Changes Tactics…Again
56. Giant ransomware bundle threatens to make malware attacks easier for crooks
57. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
58. U.S. Geological Survey Network got Infected with Malware
59. Search for “Installing Chrome” on Bing can lead to malicious content
60. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers

EXPLOIT

61. Kraken ransomware gets packaged into Fallout EK
62. How to Perform Manual SQL Injection With Double quotes Error Based String Method
63. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these

VULNERABILITY

64. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
65. Cisco Security Appliance Zero-Day Found Actively Exploited in the Wild
66. BLEEDINGBIT – Two Zero Day Vulnerabilities Affecting Wireless Access Point Bluetooth Chips
67. Hackers actively exploiting vulnerabilities in Cisco security appliances
68. Cisco fixed the high-risk security vulnerabilities in variant products
69. Bluetooth Bugs Speak to Lack of Security in DevOps
70. Sauter Quickly Patches Flaw in Building Automation Software
71. Bleedingbit vulnerabilities put Wi-Fi access points at risk
72. Test IO introduces Bug Fix Confirmation, leveraging network of software testers to verify bug fixes
73. Flaw in Sophos HitmanPro.Alert could enable hackers to gain privileges over systems
74. Intel CPUs impacted by new PortSmash side-channel vulnerability
75. CISCO warn of a zero-day DoS flaw that is being actively exploited in attacks
76. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes
77. .@ArmisSecurity researchers discovered two chip-level #Bluetooth vulnerabilities -- dubbed #Bleedingbit -- that could allow pseudo #RemoteCodeExecution on wireless access points.
78. Cisco Reports SIP Inspection Vulnerability
79. Mozilla exorcises five bugs on Halloween
80. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
81. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices
82. GNOME 3.30.2 released: bugs fix
83. Attackers Use Zero-Day That Can Restart Cisco Security Appliances

Region brief for 2018-11-02

ASIA

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Stuxnet Returns, Striking Iran with New Variant
3. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
4. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
5. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
6. Iran has become victim of a cyberattack campaign
7. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

OCEANIA

Nil

NORTH AMERICA

8. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
9. New Data Affirms Cyber Threat for Industrial Control Systems
10. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
11. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
12. SMS Phishing + Cardless ATM = Profit
13. Stuxnet Returns, Striking Iran with New Variant
14. Bluetooth Bugs Speak to Lack of Security in DevOps
15. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
16. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
17. SamSam ransomware campaigns continue to target U.S. in 2018
18. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
19. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
20. U.S. Geological Survey Network got Infected with Malware
21. 85 million voter records on sale
22. Iran has become victim of a cyberattack campaign
23. EY launches the world's first secure private transactions over the Ethereum public blockchain

SOUTH AMERICA

24. Russian hackers compromise 120 million Facebook accounts; private messages on sale online

EUROPE

25. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
26. Magecart cybergang targeting e-commerce credit card data
27. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
28. Stuxnet Returns, Striking Iran with New Variant
29. Sauter Quickly Patches Flaw in Building Automation Software
30. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
31. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
32. Beware this malware: it can even survive operating systems being reinstalled
33. Magecart claims fresh victim in electronics kit seller Kitronik
34. Iran has become victim of a cyberattack campaign
35. EY launches the world's first secure private transactions over the Ethereum public blockchain

AFRICA

Nil

Sector brief for 2018-11-02

HEALTHCARE

1. ePHI of 8,000 Patients Exposed in Health Plan Breach
2. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures

TRANSPORT

Nil

BANKING & FINANCE

3. Magecart cybergang targeting e-commerce credit card data
4. New Data Affirms Cyber Threat for Industrial Control Systems
5. SMS Phishing + Cardless ATM = Profit
6. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
7. Emotet Trojan Changes Tactics…Again
8. Shipbuilder, defense contractor Austal reveals data breach
9. Data theft at Radisson Hotel Group
10. Trading with cryptocurrencies without losing self control
11. EY launches the world's first secure private transactions over the Ethereum public blockchain

INFORMATION & TELECOMMUNICATION

12. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
13. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
14. New Data Affirms Cyber Threat for Industrial Control Systems
15. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
16. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
17. Bluetooth Bugs Speak to Lack of Security in DevOps
18. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
19. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
20. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
21. Can you spot a malicious email? Take the quiz at
22. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
23. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
24. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
25. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
26. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
27. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
28. 85 million voter records on sale
29. Search for “Installing Chrome” on Bing can lead to malicious content
30. YAPBS – Yet Another Password Breach Scam
31. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers
32. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

FOOD

Nil

WATER

Nil

ENERGY

33. New Data Affirms Cyber Threat for Industrial Control Systems
34. Bluetooth Bugs Speak to Lack of Security in DevOps
35. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
36. Iran has become victim of a cyberattack campaign
37. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices

GOVERNMENT & PUBLIC SERVICE

38. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
39. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
40. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
41. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
42. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
43. U.S. Geological Survey Network got Infected with Malware
44. 85 million voter records on sale
45. Iran has become victim of a cyberattack campaign

Daily brief for 2018-11-02

ASIA

1. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
2. Stuxnet Returns, Striking Iran with New Variant
3. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
4. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
5. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
6. Iran has become victim of a cyberattack campaign
7. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

WORLD

8. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
9. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
10. Magecart cybergang targeting e-commerce credit card data
11. New Data Affirms Cyber Threat for Industrial Control Systems
12. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
13. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
14. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
15. SMS Phishing + Cardless ATM = Profit
16. Stuxnet Returns, Striking Iran with New Variant
17. Bluetooth Bugs Speak to Lack of Security in DevOps
18. Sauter Quickly Patches Flaw in Building Automation Software
19. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
20. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
21. Beware this malware: it can even survive operating systems being reinstalled
22. Magecart claims fresh victim in electronics kit seller Kitronik
23. SamSam ransomware campaigns continue to target U.S. in 2018
24. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
25. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
26. U.S. Geological Survey Network got Infected with Malware
27. 85 million voter records on sale
28. Iran has become victim of a cyberattack campaign
29. EY launches the world's first secure private transactions over the Ethereum public blockchain

ATTACKS

30. Two botnets are fighting over control of thousands of unsecured Android devices
31. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
32. Spam campaign targets Exodus Mac Users
33. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
34. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
35. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
36. SMS Phishing + Cardless ATM = Profit
37. ePHI of 8,000 Patients Exposed in Health Plan Breach
38. Facebook has experienced a number of security-related issues lately, but it doesn't appear to be at fault for the leak
39. "While most phishing attacks on desktop and laptop computers come via email... a mobile device attack vector can be in
40. #Phishing targets data that lives outside your enterprise perimeter—putting your entire enterprise at risk. Learn how post-perimeter security enables you
41. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
42. How to password protect a folder or file in Windows | Avast
43. Russian hackers compromise 120 million Facebook accounts; private messages on sale online
44. SamSam ransomware campaigns continue to target U.S. in 2018
45. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
46. Radisson Hotel Group Hit by Data Breach
47. Spam campaign targets Exodus Mac Users
48. Just half of Fortune 500 companies have installed DMARC, a tool that guards against email phishing scams, according to new
49. Shipbuilder, defense contractor Austal reveals data breach
50. Multiple #phishing pages on multiple domains targeting Canadian citizens posing as Canadian Revenue Agency, Interac, and others 192.99.86.132 (@OVH) cc: @cybercentre_ca
51. Data theft at Radisson Hotel Group
52. 85 million voter records on sale
53. Iran has become victim of a cyberattack campaign
54. YAPBS – Yet Another Password Breach Scam
55. Apache HBase 2.1.1 release, distributed database
56. FIFA admits hack and braces for new leaks

THREATS

57. Facebook Blames Malicious Extensions in Breach of 81K Private Messages
58. Shellbot Variant Used in New Botnet, Spreads Using IoT and Linux Vulnerabilities
59. ​The day computer security turned real: The Morris Worm turns 30
60. Worst Malware and Threat Actors of 2018
61. Cisco Security Appliance Zero-Day Found Actively Exploited in the Wild
62. New Ransomware using DiskCryptor With Custom Ransom Message
63. BLEEDINGBIT – Two Zero Day Vulnerabilities Affecting Wireless Access Point Bluetooth Chips
64. #SamSam #ransomware continues to be a thorn in the side of organizations in the U.S. with targeted ransomware campaigns continuing,
65. Hackers actively exploiting vulnerabilities in Cisco security appliances
66. Cisco fixed the high-risk security vulnerabilities in variant products
67. Researchers found #Kraken #ransomware has become more popular after being packaged in the Fallout #ExploitKit and becoming part of an
68. Bluetooth Bugs Speak to Lack of Security in DevOps
69. Sauter Quickly Patches Flaw in Building Automation Software
70. Bleedingbit vulnerabilities put Wi-Fi access points at risk
71. Adversaries Distribute Malware Via Rarely Used Extensions
72. Test IO introduces Bug Fix Confirmation, leveraging network of software testers to verify bug fixes
73. Can you spot a malicious email? Take the quiz at
74. Antimalware Day: The evolution of malicious code
75. Flaw in Sophos HitmanPro.Alert could enable hackers to gain privileges over systems
76. Outlaw Hacking Group Using Command Injection Flow To Attack Organizations Network using Botnet via C&C Server
77. Intel CPUs impacted by new PortSmash side-channel vulnerability
78. Beware this malware: it can even survive operating systems being reinstalled
79. SamSam ransomware campaigns continue to target U.S. in 2018
80. CISCO warn of a zero-day DoS flaw that is being actively exploited in attacks
81. Systemd Vulnerability In Linux Could Trigger Remote Attacks And System Crashes
82. .@ArmisSecurity researchers discovered two chip-level #Bluetooth vulnerabilities -- dubbed #Bleedingbit -- that could allow pseudo #RemoteCodeExecution on wireless access points.
83. Cisco Reports SIP Inspection Vulnerability
84. Kraken ransomware gets packaged into Fallout EK
85. Emotet Trojan Changes Tactics…Again
86. Mozilla exorcises five bugs on Halloween
87. Giant ransomware bundle threatens to make malware attacks easier for crooks
88. Blockwatch: The aeternity Blockchain
89. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
90. If you think you have been hacked or got #malware installed, disconnect the internet, leave your device running and connected
91. U.S. Geological Survey Network got Infected with Malware
92. Trading with cryptocurrencies without losing self control
93. EY launches the world's first secure private transactions over the Ethereum public blockchain
94. Search for “Installing Chrome” on Bing can lead to malicious content
95. BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices
96. Previous malware attacks: When more than 7,5000 of the #Mikrotik routes were reportedly being spied on by attackers
97. GNOME 3.30.2 released: bugs fix
98. Attackers Use Zero-Day That Can Restart Cisco Security Appliances
99. Another packed room for .@idefense analyst Mei Nelson discussing China and cryptocurrency. #codeblue_jp @AccentureSecure @AccentureJPNews

CRIME

100. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
101. Magecart cybergang targeting e-commerce credit card data
102. 120 Million Facebook Accounts Compromised, Private Messages of 81,000 for Sale
103. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
104. SMS Phishing + Cardless ATM = Profit
105. Stuxnet Returns, Striking Iran with New Variant
106. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
107. How to password protect a folder or file in Windows | Avast
108. Beware this malware: it can even survive operating systems being reinstalled
109. Feds Accuse Ex-CIA Employee of Continuing Leaks From Prison
110. Radisson Hotel Group Hit by Data Breach
111. BCMUPnP_Hunter: 100,000-node botnet is abusing routers for spam
112. Emotet Trojan Changes Tactics…Again
113. Shipbuilder, defense contractor Austal reveals data breach
114. Data theft at Radisson Hotel Group
115. 85 million voter records on sale
116. Iran has become victim of a cyberattack campaign
117. Trading with cryptocurrencies without losing self control
118. EY launches the world's first secure private transactions over the Ethereum public blockchain
119. YAPBS – Yet Another Password Breach Scam
120. FIFA admits hack and braces for new leaks

POLITICS

121. Joshua Adam Schulte, ex CIA employee, accused of continuing leaks from prison
122. Spam campaign targets Exodus Mac Users
123. 85 Millions of voter records available for sale ahead of the 2018 US Midterm Elections
124. This Week in Security News: Spam Campaigns and Vulnerable Infrastructures
125. Beware this malware: it can even survive operating systems being reinstalled
126. Emotet Trojan Changes Tactics…Again
127. 85 million voter records on sale
128. Iran has become victim of a cyberattack campaign

APT report for 2018-11-01

TRANSNATIONAL / UNKNOWN

1. 0x20k of Ghost Squad Hackers Releases ODay Exploit Targeting Apache Hadoop
2. British Airways data breach bigger than originally thought
3. CBS News: A Look Behind the Magecart Assault on E-commerce

CHINA

4. DOJ indictment spotlights China’s civilian intel agency – and its hacker recruits
5. Comodo launches Dome Shield Platinum to secure and control Internet access

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

6. CSM-ACE 2018: FireEye Interview – ASEAN Countries Need to Place Greater Focus on Resourcing Their Cyber Defences

SERBIA

Nil

UKRAINE

7. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed

Platform report for 2018-11-01

WINDOWS

1. Trickbot Malware Now Also Steals Passwords From Apps, Web Browsers
2. Emotet Malware, the Most Probable Malware of the Year
3. More Typo-Squatting Malware Found on PyPI
4. Windows Defender Bug Needs a Restart, Not Shutdown, To Enable Sandbox
5. Healthcare Industry Continues To Be the Favourite for Ransomware
6. Trickbot Shows Off New Trick: Password Grabber Module
7. SamSam Attackers Have Hit 67 Ransomware Targets
8. Talos Vulnerability Deep Dive - TALOS-2018-0636 / CVE-2018-3971 Sophos HitmanPro.Alert vulnerability
9. Perl-Based Shellbot Looks to Target Organizations via C&C

LINUX

10. Open Letter to Francisco Partners: Continued Misuse of NSO Group’s Pegasus Technology
11. DOJ indictment spotlights China’s civilian intel agency – and its hacker recruits
12. 0x20k of Ghost Squad Hackers Releases ODay Exploit Targeting Apache Hadoop
13. Perl-Based Shellbot Looks to Target Organizations via C&C

UNIX

Nil

ANDROID

14. Government employee who used to watch porn at work alleged guilty of infecting with malware a network
15. Perl-Based Shellbot Looks to Target Organizations via C&C

IOS

Nil

MACOS

Nil

Threat report for 2018-11-01

DATA BREACH & DATA LOSS

1. Australian defence contractor Austal hit by data breach
2. Radisson discloses data breach impacting rewards customers
3. 22,000 Records Exposed by JoomlArt in Jira Ticket
4. ‘Aaron Smith’ Sextortion scam campaigns hit tens of thousands of individuals
5. New Bluetooth Vulnerabilities Exposed in Aruba, Cisco, Meraki Access Points
6. Customer Information Stolen in Radisson Hotel Group Data Breach
7. British Airways data breach bigger than originally thought
8. Where Is the Consumer Outrage about Data Breaches?
9. Eurostar Resets Passwords of Customers After Data Breach
10. Radisson Hotel Group suffers data breach, customer info leaked
11. Radisson Rewards Program Targeted in Data Breach
12. "If the schemas prove not to be compatible, a backup of the previous version of a database must be used
13. Emotet Malware – Mass-Harvesting millions of Emails in secret Campaign
14. Last year the @USAgov required agencies to implement #DMARC records and policies by October 2018. Learn just how hard DMARC
15. New Ramnit Campaign Spreads Azorult Malware
16. #NetSpectre leaks data remotely via side-channel attacks. Learn from expert Michael Cobb of @thehairyITdog why data from #microprocessors is not
17. Phishing Attacks Breach 20,000 Patient Records of Catawba Valley Medical Center
18. Radisson Hotel Group Data Breach Exposed Customer’s Personal Data
19. Beware !! Square & PayPal Mobile Point of Sales (POS) Devices Are Extremely Vulnerable to Credit/Debit Card Data Theft

DENIAL-OF-SERVICE

20. Cisco ups the ante for 400G Ethernet with big-bandwidth data-center switches

MALVERTISING

21. Bad ads: Publishers look to stop malvertising for good

PHISHING

22. How phishing is evolving to outpace awareness
23. Going with what works: The state of phishing
24. October may be over – but phishing attacks never stop. Here’s how to make security awareness successful all year round.
25. Trickbot Shows Off New Trick: Password Grabber Module
26. Expert Insights Names Barracuda’s AI powered Sentinel Top Phishing protection product
27. Phishing Attacks Breach 20,000 Patient Records of Catawba Valley Medical Center

WEB DEFACEMENT

Nil

BOTNET

28. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
29. Defending your pumpkin from tracker zombies
30. Necurs Botnet Distributing Sextortion Email Scams
31. The Russian built #VPNFilter #botnet was taken down by the @FBI after over 500,000 routers were infected. However, VPNFilter is

RANSOMWARE

32. Ransomware and Back-Up Plans
33. Healthcare Industry Continues To Be the Favourite for Ransomware
34. SamSam Attackers Have Hit 67 Ransomware Targets
35. Nice work if you can get it: GandCrab ransomware nets millions even though it has been broken
36. Crypto-Locking Kraken Ransomware Looms Larger

CRYPTOMINING & CRYPTOCURRENCIES

37. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
38. UK considers banning cryptocurrencies for their lack of “intrinsic value”
39. Crypto-Locking Kraken Ransomware Looms Larger
40. Crypto Micropayments: an Exciting Future for Blockchain Transactions

MALWARE

41. 2018’s worst malware revealed in report
42. Trickbot Malware Now Also Steals Passwords From Apps, Web Browsers
43. Emotet Malware, the Most Probable Malware of the Year
44. USB Drives Deliver Dangerous Malware to Industrial Facilities: Honeywell
45. More Typo-Squatting Malware Found on PyPI
46. Employee used US government network for adult websites, infected infrastructure with Russian malware
47. Government employee who used to watch porn at work alleged guilty of infecting with malware a network
48. Malware Analysis for Blue Teams
49. Emotet Malware – Mass-Harvesting millions of Emails in secret Campaign
50. Hackers Drops New Emotet Malware to Perform Mass Email Exfiltration From Victims Email Client
51. New Ramnit Campaign Spreads Azorult Malware
52. Perl-Based Shellbot Looks to Target Organizations via C&C
53. IKARUS Security Software partners with PolySwarm to advance early malware detection
54. Pdgmail – Forensic Tool to Analysis Process Memory Dump

EXPLOIT

55. PoC Exploit Compromises Microsoft Live Accounts via Subdomain Hijacking
56. 0x20k of Ghost Squad Hackers Releases ODay Exploit Targeting Apache Hadoop
57. Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition

VULNERABILITY

58. Yi IoT Home Camera Riddled with Code-Execution Vulnerabilities
59. BLEEDINGBIT Bluetooth flaws in TI chips expose enterprises to remote attacks
60. New Bluetooth Vulnerabilities Exposed in Aruba, Cisco, Meraki Access Points
61. Windows Defender Bug Needs a Restart, Not Shutdown, To Enable Sandbox
62. Bluetooth Chip Flaws Expose Enterprises to Remote Attacks
63. Two Zero-Day Bugs Open Millions of Wireless Access Points to Attack
64. Cisco says a flaw in its Adaptive Security Appliance allows remote attacks
65. Talos Vulnerability Deep Dive – TALOS-2018-0636 / CVE-2018-3971 Sophos HitmanPro.Alert vulnerability
66. Security researchers find flaws in chips used in hospitals, factories and stores
67. Bleedingbit: Critical vulnerabilities in BLE chips expose millions of access points to attack
68. Bleedingbit zero-day chip flaws may expose majority of enterprises to remote code execution attacks
69. Cisco Zero-Day Exploited In The Wild To Crash And Reload Devices
70. Zero-Day RCE Vulnerabilities Expose Millions of BLE-Enabled Devices to Attacks
71. Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition
72. New BLEEDINGBIT Vulnerabilities Affect Widely-Used Bluetooth Chips
73. Two New Bluetooth Chip Flaws Expose Millions of Devices to Remote Attacks
74. .@Siemens disclosed six SICLOCK flaws that were found within its central plant clocks. Discover why three flaws have been rated
75. Our fabulous @5ean5ullivan explains to @CyberSauna listeners how the multiple vulnerabilities in the US electoral system may be^H^H^H^H^H^Hare being exploited.
76. Bleedingbit Bluetooth Vulnerabilities Expose WiFi APs to Risk
77. Talos Vulnerability Deep Dive - TALOS-2018-0636 / CVE-2018-3971 Sophos HitmanPro.Alert vulnerability
78. Cisco Warns of Zero-Day Vulnerability in Security Appliances
79. Cisco zero-day exploited in the wild to crash and reload devices

Region brief for 2018-11-01

ASIA

1. ‘Aaron Smith’ Sextortion scam campaigns hit tens of thousands of individuals
2. Open Letter to Francisco Partners: Continued Misuse of NSO Group’s Pegasus Technology
3. DOJ indictment spotlights China’s civilian intel agency – and its hacker recruits
4. Trickbot Shows Off New Trick: Password Grabber Module
5. SamSam Attackers Have Hit 67 Ransomware Targets
6. Perl-Based Shellbot Looks to Target Organizations via C&C
7. CSM-ACE 2018: FireEye Interview – ASEAN Countries Need to Place Greater Focus on Resourcing Their Cyber Defences

OCEANIA

8. Australian defence contractor Austal hit by data breach
9. Trickbot Shows Off New Trick: Password Grabber Module
10. SamSam Attackers Have Hit 67 Ransomware Targets

NORTH AMERICA

11. Australian defence contractor Austal hit by data breach
12. BLEEDINGBIT Bluetooth flaws in TI chips expose enterprises to remote attacks
13. Emotet Malware, the Most Probable Malware of the Year
14. Open Letter to Francisco Partners: Continued Misuse of NSO Group’s Pegasus Technology
15. New Bluetooth Vulnerabilities Exposed in Aruba, Cisco, Meraki Access Points
16. DOJ indictment spotlights China’s civilian intel agency – and its hacker recruits
17. Bleedingbit: Critical vulnerabilities in BLE chips expose millions of access points to attack
18. Healthcare Industry Continues To Be the Favourite for Ransomware
19. Employee used US government network for adult websites, infected infrastructure with Russian malware
20. CBS News: A Look Behind the Magecart Assault on E-commerce
21. UK considers banning cryptocurrencies for their lack of “intrinsic value”
22. Government employee who used to watch porn at work alleged guilty of infecting with malware a network
23. Trickbot Shows Off New Trick: Password Grabber Module
24. SamSam Attackers Have Hit 67 Ransomware Targets
25. Our fabulous @5ean5ullivan explains to @CyberSauna listeners how the multiple vulnerabilities in the US electoral system may be^H^H^H^H^H^Hare being exploited.
26. Hackers Drops New Emotet Malware to Perform Mass Email Exfiltration From Victims Email Client
27. Talos Vulnerability Deep Dive - TALOS-2018-0636 / CVE-2018-3971 Sophos HitmanPro.Alert vulnerability
28. Perl-Based Shellbot Looks to Target Organizations via C&C
29. Beware !! Square & PayPal Mobile Point of Sales (POS) Devices Are Extremely Vulnerable to Credit/Debit Card Data Theft

SOUTH AMERICA

30. Perl-Based Shellbot Looks to Target Organizations via C&C

EUROPE

31. ‘Aaron Smith’ Sextortion scam campaigns hit tens of thousands of individuals
32. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
33. DOJ indictment spotlights China’s civilian intel agency – and its hacker recruits
34. British Airways data breach bigger than originally thought
35. Eurostar Resets Passwords of Customers After Data Breach
36. Employee used US government network for adult websites, infected infrastructure with Russian malware
37. CBS News: A Look Behind the Magecart Assault on E-commerce
38. UK considers banning cryptocurrencies for their lack of “intrinsic value”
39. Trickbot Shows Off New Trick: Password Grabber Module
40. Radisson Rewards Program Targeted in Data Breach
41. SamSam Attackers Have Hit 67 Ransomware Targets
42. Perl-Based Shellbot Looks to Target Organizations via C&C
43. The Russian built #VPNFilter #botnet was taken down by the @FBI after over 500,000 routers were infected. However, VPNFilter is
44. CSM-ACE 2018: FireEye Interview – ASEAN Countries Need to Place Greater Focus on Resourcing Their Cyber Defences

AFRICA

Nil