Daily brief for 2018-10-11

ASIA

1. Cybersecurity Authorities Issue Alert About Publicly Available Hacking Tools
2. AA18-284A: Publicly Available Tools Seen in Cyber Incidents Worldwide
3. What would happen if an attack interrupted a country’s power supply?
4. Reaper Group Uses New Malware to Deploy RAT
5. Threats in the Netherlands

WORLD

6. Exaramel Malware Links Industroyer ICS malware and NotPetya wiper
7. Cybersecurity Authorities Issue Alert About Publicly Available Hacking Tools
8. The Reality of Self-Driving Cars and the Regulatory Hurdles
9. Adaptable, All-in-One Android Trojan Shows the Future of Malware
10. Talos: Android trojan resembling Play Store installs sophisticated spyware
11. AA18-284A: Publicly Available Tools Seen in Cyber Incidents Worldwide
12. The EU and the US have investigated on data breaches on the Google+
13. Researchers link tools used in NotPetya and Ukraine grid hacks
14. What would happen if an attack interrupted a country’s power supply?
15. Cops Arrest Infamous SIM Swapper Who Allegedly Stole $14 Million in Cryptocurrency
16. Reaper Group Uses New Malware to Deploy RAT
17. Worker perks flinger Sodexo pulls Engage website after malware smackdown
18. Defending Against Business Email Compromise Attacks
19. Heathrow Airport, the busiest airport in the United Kingdom, has been fined £120,000 (about $158,173) following a data breach caused
20. Microsoft October Patch Tuesday fixed Win32k privilege vulnerability that used in targeted attacks
21. Threats in the Netherlands
22. New Gallmaker APT group eschews malware in cyber espionage campaigns
23. Italian Police Finally Identified 25-Year-old Italian Hacker who have Defaced NASA Websites
24. GPlayed Trojan - .Net playing with Google Market
25. Ghostdns Attack Compromised Over 100K Routers
26. Canada-Based Restaurant Chain Hit with Malware Attack

ATTACKS

27. The BEC List: Helping Thwart Business Email Compromise through Collaboration
28. Personal data for coffee. What’s the risk? | Avast
29. California Bill Increases Default Password Security
30. The EU and the US have investigated on data breaches on the Google+
31. FitMetrix user data exposed via passwordless ElasticSearch server cluster
32. Apple has formed a partnership with lyrics database provider Genius
33. Cofense Report Reveals 10 Percent of User-Reported Emails Across Key Industries are Malicious, Over Half Tied to Credential Phishing
34. Hackers launched #phishing attacks against @netflix users via malicious sites with TLS certificates. Learn how hackers mimic popular websites to
35. Defending Against Business Email Compromise Attacks
36. Heathrow Airport, the busiest airport in the United Kingdom, has been fined £120,000 (about $158,173) following a data breach caused
37. Palo Alto Networks Uncovers Flash Updater Cryptojacking Campaign
38. Gemalto reports that 4.6 billion record leaked in the first half of 2018
39. A new database with information on every shooting at a school in the last 50 years is now available publicly
40. New Gallmaker APT group eschews malware in cyber espionage campaigns
41. Ghostdns Attack Compromised Over 100K Routers
42. A simple videocall could compromise your WhatsApp account
43. Mingis on Tech: Data breaches and the rise of 'surveillance capitalism'
44. Mingis on Tech: Data breaches in a world of 'surveillance capitalism'
45. Avast 2019: Extends Artificial Intelligence Technology to Block Advanced Phishing Attacks for Enhanced Consumer Security
46. AVG 2019 now includes enhanced phishing threat detection

THREATS

47. Exaramel Malware Links Industroyer ICS malware and NotPetya wiper
48. Multiple Vulnerabilities Dicovered In RouterOS That Affected MikroTik Routers
49. GPlayed Android Trojan Can Wipe Your Device, Steal Data, Make Calls, Send SMS
50. Senate seeks internal memo on Google+ vulnerability
51. XMRig Cryptocurrency Miner Camouflages Itself as a Flash Updater
52. Slow disclosure of Google+ flaw draws attention of senators
53. Hackers Exploit Drupalgeddon2 to Install Backdoor
54. PoC Code Available for Microsoft Edge Remote Code Execution Bug
55. Adaptable, All-in-One Android Trojan Shows the Future of Malware
56. Talos: Android trojan resembling Play Store installs sophisticated spyware
57. Most Malware Arrives Via Email
58. .@Google Firebase's lack of #DatabaseSecurity and inadequate #BackendDevelopment led to #DataLeaks and vulnerabilities, including HospitalGown. Learn more about this
59. Cops Arrest Infamous SIM Swapper Who Stole Crypto Currency
60. Network Time Protocol Bugs Sting Juniper Operating System
61. Juniper Networks provides dozens of fix for vulnerabilities in Junos OS
62. Audit Finds No Critical Flaws in Firefox Update System
63. Fake Adobe Flash Updates Hide Malicious Crypto Miners
64. [SingCERT] Alert on 12 Critical Microsoft Vulnerabilities for October 2018 Patch Tuesday
65. Cops Arrest Infamous SIM Swapper Who Allegedly Stole $14 Million in Cryptocurrency
66. .@TrendMicro researchers discovered a malicious #ChromeExtension spreading #malware. Learn more with expert @lewisnic.
67. GPlayed trojan – .Net playing with Google Market
68. Cryptomining malware discovered masquerading as Flash updates
69. This cryptojacking mining malware pretends to be a Flash update
70. Fake Flash Updaters Push Cryptocurrency Miners
71. Hackers Abusing Legitimate Googlebot Services to Inject Cryptomining Malware
72. Reaper Group Uses New Malware to Deploy RAT
73. Cofense Report Reveals 10 Percent of User-Reported Emails Across Key Industries are Malicious, Over Half Tied to Credential Phishing
74. Exaramel Malware Reinforces Link Between Industroyer and NotPetya
75. A patched #MikroTik router vulnerability amps up severity rating as @TenableSecurity researchers find new potential exploits with more critical consequences.
76. New TeleBots backdoor: First evidence linking Industroyer to NotPetya
77. New TeleBots backdoor: First evidence linking Industroyer to NotPetya
78. New Android Trojan Gplayed Adapts to Attacker's Needs
79. Juniper fixes 30+ vulnerabilities in its routing, switching devices
80. Researchers from @alienvault found a new #cryptocurrency mining malware -- dubbed #MassMiner -- that infects systems across the web. Learn
81. Adobe patches critical flaws in many of its software offerings
82. Update now! Microsoft fixes 49 bugs, 12 are critical
83. Hackers launched #phishing attacks against @netflix users via malicious sites with TLS certificates. Learn how hackers mimic popular websites to
84. Qihoo 360’s precise analysis of ransomware for September
85. Costly cryptojacking overtakes ransomware in the enterprise threat stakes
86. Crypto-mining malware poses as Flash updates
87. All WhatsApp Users Must Update: Zero Day Bug Found in WhatsApp
88. Who needs custom malware? 'Govt-backed' Gallmaker spy crew uses off-the-shelf wares
89. Worker perks flinger Sodexo pulls Engage website after malware smackdown
90. VMware issues advisory for a DoS vulnerability
91. .@TenableSecurity found new exploits of an already patched #MikroTik router vulnerability that could enable hackers to launch #RemoteCode execution attacks.
92. New Backdoor Ties NotPetya and Industroyer to TeleBots Group
93. Juniper Patches Serious Flaws in Junos OS
94. Microsoft October Patch Tuesday fixed Win32k privilege vulnerability that used in targeted attacks
95. .@FarsightSecInc's @paulvixie says his company's new research into domain name lifespans and causes of death shows the need for new
96. "Help! I have a #computer worm..oh wait is it a computer #virus?" These terms are often used interchangeably, but have
97. The attached file promptly infects Peter’s laptop with the RAT, remote access trojan. It only takes about an hour from
98. New Gallmaker APT group eschews malware in cyber espionage campaigns
99. GPlayed Trojan - .Net playing with Google Market
100. Dublin Information Sec: Protect your firm from 'Gold Rush' #cryptocurrency scammers: https://www.independent.ie/business/dublin-information-sec/dublin-information-sec-protect-your-firm-from-gold-rush-cryptocurrency-scammers-37286913.html … ( via @jimmychappell )
101. Canada-Based Restaurant Chain Hit with Malware Attack
102. Hackers Use Hijacked Email Address To Send Malware as a Reply to Existing Email Thread
103. JSRAT – Secret Command and Control Channel Backdoor to Control Victims Machine Using JavaScript
104. Four Critical Flaws Patched In Adobe Digital Edition
105. How to Defeat Malicious Everything as-a-Service

CRIME

106. The BEC List: Helping Thwart Business Email Compromise through Collaboration
107. PoC Code Available for Microsoft Edge Remote Code Execution Bug
108. The EU and the US have investigated on data breaches on the Google+
109. Cops Arrest Infamous SIM Swapper Who Allegedly Stole $14 Million in Cryptocurrency
110. Cofense Report Reveals 10 Percent of User-Reported Emails Across Key Industries are Malicious, Over Half Tied to Credential Phishing
111. Defending Against Business Email Compromise Attacks
112. Gemalto reports that 4.6 billion record leaked in the first half of 2018
113. Threats in the Netherlands

POLITICS

114. What would happen if an attack interrupted a country’s power supply?
115. Cops Arrest Infamous SIM Swapper Who Allegedly Stole $14 Million in Cryptocurrency
116. Who needs custom malware? 'Govt-backed' Gallmaker spy crew uses off-the-shelf wares
117. Threats in the Netherlands
118. New Gallmaker APT group eschews malware in cyber espionage campaigns
119. Italian Police Finally Identified 25-Year-old Italian Hacker who have Defaced NASA Websites
120. A simple videocall could compromise your WhatsApp account
121. Avast 2019: Extends Artificial Intelligence Technology to Block Advanced Phishing Attacks for Enhanced Consumer Security
122. JSRAT – Secret Command and Control Channel Backdoor to Control Victims Machine Using JavaScript

APT report for 2018-10-10

TRANSNATIONAL / UNKNOWN

1. Thieves and Geeks: Russian and Chinese Hacking Communities
2. Magecart Attack Hits 'Shopper Approved'
3. Magecart hacks Shopper Approved to simultaneously hit many e-commerce sites
4. Payment-card-skimming Magecart strikes again: Zero out of five for infecting e-retail sites
5. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
6. Magecart Hits Popular Customer Review Plugin
7. Shopper Approved, the new victim of the Magecart hacking group

CHINA

8. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft

INDIA

Nil

NORTH KOREA

9. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
10. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks

PAKISTAN

Nil

VIETNAM

Nil

IRAN

11. MuddyWater Threat Actor Expands Targets List
12. MuddyWater expands operations

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

13. Thieves and Geeks: Russian and Chinese Hacking Communities
14. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
15. Zero-day exploit (CVE-2018-8453) used in targeted attacks

SERBIA

Nil

UKRAINE

16. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
17. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks

Platform report for 2018-10-10

WINDOWS

1. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
2. FruityArmor APT Exploits Yet Another Windows Graphics Kernel Flaw
3. Microsoft Added Severity Levels to Feedback Hub Bug Reports for Windows 10
4. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
5. Microsoft has fixed the Windows 10 October Update data deletion bug
6. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
7. MuddyWater expands operations
8. October 2018 Patch Tuesday: Microsoft fixes 49 flaws, one APT-wielded zero-day
9. Microsoft WindowsCodecs.dll SniffAndConvertToWideString Information Leak Vulnerability
10. Apple Released Security Updates for iOS 12.0.1 & iCloud with the Fixes for 21 Vulnerabilities
11. Microsoft Fixes Zero Day and Data Deletion Bugs
12. Zero-day exploit (CVE-2018-8453) used in targeted attacks
13. Windows Zero-Day Exploited in Attacks Aimed at Middle East
14. Microsoft Released Security Updates & Fixed 49 Vulnerabilities that Affected Microsoft Products
15. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
16. Old-School Malware Tricks Still Work
17. Zero trust security: 5 reasons it’s not just about passwords

LINUX

Nil

UNIX

Nil

ANDROID

18. Google Restricts Android Apps From Accessing Your Personal Data
19. WhatsApp Fixes Vulnerability That’s Triggered by Answering a Call.
20. WhatsApp fixes video call bug that could have let hackers in, says report
21. Hackers can compromise your WhatsApp account by tricking you into answering a video call
22. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
23. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
24. WhatsApp fixes bug that let hackers take over app when answering a video call
25. Zero trust security: 5 reasons it’s not just about passwords

IOS

26. WhatsApp Fixes Vulnerability That’s Triggered by Answering a Call.
27. WhatsApp fixes video call bug that could have let hackers in, says report
28. Leaks suggest Samsung is working on a mid-range smartphone with four cameras
29. Hackers can compromise your WhatsApp account by tricking you into answering a video call
30. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
31. Apple Released Security Updates for iOS 12.0.1 & iCloud with the Fixes for 21 Vulnerabilities
32. WhatsApp fixes bug that let hackers take over app when answering a video call
33. Zero trust security: 5 reasons it’s not just about passwords

MACOS

Nil

Threat report for 2018-10-10

DATA BREACH & DATA LOSS

1. Campaign 2018: These hacking groups could target the 2018 midterm elections
2. 4.5 Billion Records Stolen in Data Breaches in the First Six Months of 2018
3. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
4. Google Restricts Android Apps From Accessing Your Personal Data
5. Triangulating Beyond the Hack: Stolen Records Just One Tool in a Comprehensive Kit
6. #NetSpectre exploits leak data remotely via side-channel attacks. Learn how to use #ThreatModeling to stop speculative execution from expert Ed
7. A Google security audit uncovered a glitch in Google+ that exposed data from nearly 500,000 accounts. Ping CTO West @baber
8. Razer Phone 2 leaks hours before announcement: wireless charging and IP67 water resistance
9. Goodbye Google Plus – Google Plans Google+ Shut Down After Data Breach
10. The #TLBleed vulnerability uses @Intel's HTT chip feature to leak data. Learn about how hackers could use #malware to launch
11. New state-backed espionage campaign targets military and government using freely available hacking tools
12. Flaw in Ghostscript sandbox allowed system compromise
13. Leaks suggest Samsung is working on a mid-range smartphone with four cameras
14. Rebound Orthopedics & Neurosurgery hacked; 2,800 records exposed
15. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials are openly
16. Hackers can compromise your WhatsApp account by tricking you into answering a video call
17. Google+ API glitch exposed user profile data to developers
18. 291 records breached per second in first half of 2018
19. Hackers can use legitimate #AdminTools to compromise networks. Learn more about "living off the land" attacks from expert Michael Cobb
20. Don't make us pay compensation for employee data breach, Morrisons begs UK court
21. A $12 million case of business email compromise.
22. Microsoft WindowsCodecs.dll SniffAndConvertToWideString Information Leak Vulnerability
23. A #Google security audit uncovered a glitch in #GooglePlus that exposed data from nearly 500,000 accounts, causing the company to
24. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan
25. '5,000 UK firms' financial details exposed in data breaches' http://www.cityam.com/264491/uk-business-emails-could-represent-major-cyber-security … @CityAM Read the full research report here:
26. New Phishing Campaign Drops Ursnif into Conversation Threads
27. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
28. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
29. Leak reveals Google's Chinese search engine is months away from launch
30. PHASE 2 - INITIAL INTRUSION Number One decides it is time to launch a targeted spearphishing campaign. Through the newsletter, he learns
31. My Health Record justifications 'kind of lame': Godwin
32. Just Answering A Video Call Could Compromise Your WhatsApp Account
33. .@Google Firebase #DatabaseSecurity proved insufficient when bypassed by hackers to leak data. Learn more about this #SecurityFlaw from expert Michael

DENIAL-OF-SERVICE

34. Ubisoft Hit With DDoS Attack During The Launch of Assassin’s Creed: Odyssey
35. DDoS Attacks Target Multiple Games including Final Fantasy XIV
36. Researchers have recently observed an alarming trend: #DDoS attacks are multiplying in size, often far exceeding what many service providers
37. Acorus Network protects enterprises and service providers from DDoS attacks

MALVERTISING

Nil

PHISHING

38. “You have 48 hours after reading this letter”– How to Identify the Latest Phishing Scam
39. Cyber Fraud Ring Used Phishing to Steal $4 Million, Alleged Leader Faces Charges
40. Innovative Phishing Tactic Makes Inroads Using Azure Blob
41. Follow @PhishingAi to stay up to date on #phishing attacks and trends!
42. Emerging threat: password stuffing explained
43. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
44. The spearphishing email contained a zip folder with a custom-built remote access trojan (RAT). Once executed, it would connect back to
45. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
46. New Phishing Campaign Drops Ursnif into Conversation Threads
47. PHASE 2 - INITIAL INTRUSION Number One decides it is time to launch a targeted spearphishing campaign. Through the newsletter, he learns
48. Zero trust security: 5 reasons it’s not just about passwords

WEB DEFACEMENT

Nil

BOTNET

49. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion

RANSOMWARE

50. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
51. Decrypting GandCrab Ransomware
52. Cryptomining replaces ransomware as 2018's top cybersecurity threat
53. Port of San Diego Hit by a Ransomware Attack Affecting its Computer Systems

CRYPTOMINING & CRYPTOCURRENCIES

54. #ISC2Congress: The Promise of Blockchain
55. Cryptomining replaces ransomware as 2018's top cybersecurity threat
56. Why Apple must be looking into using blockchain
57. Hacker steals over $30k USD in cryptocurrency of SpankChain

MALWARE

58. CCSP Domain 4: Cloud Application Security
59. CCSP Domain 3: Cloud Platform and Infrastructure Security
60. CCSP Domain 2: Cloud Data Security
61. CCSP Domain 1: Architectural Concepts & Design Requirements
62. The CAP Exam: Application Process, Rules and Eligibility, Exam Length and More
63. Top 5 ThreatConnect Resources for Malware Analysis
64. KeyBoy Abuses Popular Office Exploits for Malware Delivery
65. Malware 101: How Malware Avoids Static Detection Techniques
66. The #TLBleed vulnerability uses @Intel's HTT chip feature to leak data. Learn about how hackers could use #malware to launch
67. CSEU 2018: Nato grappling with implications of cyberspace as domain of warfare
68. Symantec reveals state-sponsored group that doesn’t care for malware
69. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
70. Stegware: How is #malware using #steganography techniques to avoid detection?
71. The spearphishing email contained a zip folder with a custom-built remote access trojan (RAT). Once executed, it would connect back to
72. A remote access #Trojan -- dubbed #GravityRAT -- was discovered by Cisco Talos (@TalosSecurity) to be checking for #antimalware sandboxes.
73. Gallmaker: New Attack Group Eschews Malware to Live off the Land
74. Old-School Malware Tricks Still Work
75. "Creation of complex malware and organisation of multi-layered targeted attacks has shifted from financially motivated cyber-criminals to state-sponsored threat actors"
76. At the 2018 @RSAConference, researchers discussed the rise of stegware -- #malware that uses #steganography techniques to avoid detection. Learn

EXPLOIT

77. Zero-day exploit (CVE-2018-8453) used in targeted attacks

VULNERABILITY

78. FruityArmor APT Exploits Yet Another Windows Graphics Kernel Flaw
79. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
80. WhatsApp Fixes Vulnerability That’s Triggered by Answering a Call.
81. WhatsApp fixes video call bug that could have let hackers in, says report
82. Microsoft Added Severity Levels to Feedback Hub Bug Reports for Windows 10
83. Vulnerabilities found in Intel Unified Shader compiler
84. The #TLBleed vulnerability uses @Intel's HTT chip feature to leak data. Learn about how hackers could use #malware to launch
85. Flaw in Ghostscript sandbox allowed system compromise
86. Four Critical Flaws Patched in Adobe Digital Edition
87. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
88. SAP Patches Critical Vulnerability in BusinessObjects
89. A @Google #SecurityAudit uncovered privacy flaws and potential exposure of #PersonalData, leading to API changes, the shutdown of #GooglePlus and
90. #Shodan can be a helpful tool for security professionals to locate #ICSsecurity vulnerabilities. Expert Ernie Hayden explains how Shodan works
91. Security Vulnerabilities in US Weapons Systems
92. Microsoft Patch Tuesday update covers zero-day, 12 critical issues
93. Many Siemens Products Affected by Foreshadow Vulnerabilities
94. Microsoft has fixed the Windows 10 October Update data deletion bug
95. It's October 2018, and Exchange can be pwned by an 8 year-old... bug
96. Adobe security update fixes a handful of critical bugs, ignores Flash Player
97. .@FBI, @DHSgov call on users to mitigate #RemoteDesktop Protocol vulnerabilities and handle RDP exploits on their own, even as the
98. October 2018 Patch Tuesday: Microsoft fixes 49 flaws, one APT-wielded zero-day
99. Microsoft WindowsCodecs.dll SniffAndConvertToWideString Information Leak Vulnerability
100. Adobe October Security Update fixes 20 security flaws
101. Apple Released Security Updates for iOS 12.0.1 & iCloud with the Fixes for 21 Vulnerabilities
102. Google+ to shut down due to lack of adoption and privacy bug
103. Microsoft Fixes Zero Day and Data Deletion Bugs
104. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan
105. Zero-day exploit (CVE-2018-8453) used in targeted attacks
106. Windows Zero-Day Exploited in Attacks Aimed at Middle East
107. Bug bounties not a silver bullet, Katie Moussouris warns
108. Microsoft Released Security Updates & Fixed 49 Vulnerabilities that Affected Microsoft Products
109. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
110. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
111. WhatsApp fixes bug that let hackers take over app when answering a video call

Region brief for 2018-10-10

ASIA

1. KeyBoy Abuses Popular Office Exploits for Malware Delivery
2. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
3. Thieves and Geeks: Russian and Chinese Hacking Communities
4. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
5. MuddyWater expands operations
6. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
7. Leak reveals Google's Chinese search engine is months away from launch

OCEANIA

8. My Health Record justifications 'kind of lame': Godwin

NORTH AMERICA

9. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
10. Campaign 2018: These hacking groups could target the 2018 midterm elections
11. Top 5 ThreatConnect Resources for Malware Analysis
12. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
13. Thieves and Geeks: Russian and Chinese Hacking Communities
14. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
15. Rebound Orthopedics & Neurosurgery hacked; 2,800 records exposed
16. Security Vulnerabilities in US Weapons Systems
17. Don't make us pay compensation for employee data breach, Morrisons begs UK court
18. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
19. MuddyWater expands operations
20. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
21. Zero-day exploit (CVE-2018-8453) used in targeted attacks
22. Acorus Network protects enterprises and service providers from DDoS attacks

SOUTH AMERICA

23. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks

EUROPE

24. Cyber Fraud Ring Used Phishing to Steal $4 Million, Alleged Leader Faces Charges
25. A Google security audit uncovered a glitch in Google+ that exposed data from nearly 500,000 accounts. Ping CTO West @baber
26. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
27. Thieves and Geeks: Russian and Chinese Hacking Communities
28. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
29. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
30. A @Google #SecurityAudit uncovered privacy flaws and potential exposure of #PersonalData, leading to API changes, the shutdown of #GooglePlus and
31. Don't make us pay compensation for employee data breach, Morrisons begs UK court
32. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
33. MuddyWater expands operations
34. Ubisoft Hit With DDoS Attack During The Launch of Assassin’s Creed: Odyssey
35. Magecart Hits Popular Customer Review Plugin
36. A #Google security audit uncovered a glitch in #GooglePlus that exposed data from nearly 500,000 accounts, causing the company to
37. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
38. '5,000 UK firms' financial details exposed in data breaches' http://www.cityam.com/264491/uk-business-emails-could-represent-major-cyber-security … @CityAM Read the full research report here:
39. Shopper Approved, the new victim of the Magecart hacking group

AFRICA

40. MuddyWater expands operations

Sector brief for 2018-10-10

HEALTHCARE

1. #ISC2Congress: The Promise of Blockchain
2. Rebound Orthopedics & Neurosurgery hacked; 2,800 records exposed
3. Acorus Network protects enterprises and service providers from DDoS attacks

TRANSPORT

4. Thieves and Geeks: Russian and Chinese Hacking Communities
5. Hackers can compromise your WhatsApp account by tricking you into answering a video call
6. Port of San Diego Hit by a Ransomware Attack Affecting its Computer Systems

BANKING & FINANCE

7. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
8. #ISC2Congress: The Promise of Blockchain
9. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
10. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
11. Thieves and Geeks: Russian and Chinese Hacking Communities
12. Symantec reveals state-sponsored group that doesn’t care for malware
13. Rebound Orthopedics & Neurosurgery hacked; 2,800 records exposed
14. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials are openly
15. Payment-card-skimming Magecart strikes again: Zero out of five for infecting e-retail sites
16. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
17. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
18. '5,000 UK firms' financial details exposed in data breaches' http://www.cityam.com/264491/uk-business-emails-could-represent-major-cyber-security … @CityAM Read the full research report here:
19. New Phishing Campaign Drops Ursnif into Conversation Threads
20. Old-School Malware Tricks Still Work
21. Hacker steals over $30k USD in cryptocurrency of SpankChain
22. Shopper Approved, the new victim of the Magecart hacking group
23. Acorus Network protects enterprises and service providers from DDoS attacks

INFORMATION & TELECOMMUNICATION

24. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
25. Top 5 ThreatConnect Resources for Malware Analysis
26. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
27. WhatsApp Fixes Vulnerability That’s Triggered by Answering a Call.
28. WhatsApp fixes video call bug that could have let hackers in, says report
29. Follow @PhishingAi to stay up to date on #phishing attacks and trends!
30. Thieves and Geeks: Russian and Chinese Hacking Communities
31. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
32. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials are openly
33. Hackers can compromise your WhatsApp account by tricking you into answering a video call
34. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
35. A $12 million case of business email compromise.
36. MuddyWater expands operations
37. '5,000 UK firms' financial details exposed in data breaches' http://www.cityam.com/264491/uk-business-emails-could-represent-major-cyber-security … @CityAM Read the full research report here:
38. Researchers have recently observed an alarming trend: #DDoS attacks are multiplying in size, often far exceeding what many service providers
39. Old-School Malware Tricks Still Work
40. Just Answering A Video Call Could Compromise Your WhatsApp Account
41. WhatsApp fixes bug that let hackers take over app when answering a video call

FOOD

Nil

WATER

Nil

ENERGY

42. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
43. Zero trust security: 5 reasons it’s not just about passwords

GOVERNMENT & PUBLIC SERVICE

44. Campaign 2018: These hacking groups could target the 2018 midterm elections
45. MuddyWater expands operations
46. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan

Daily brief for 2018-10-10

ASIA

1. KeyBoy Abuses Popular Office Exploits for Malware Delivery
2. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
3. Thieves and Geeks: Russian and Chinese Hacking Communities
4. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
5. MuddyWater expands operations
6. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
7. Leak reveals Google's Chinese search engine is months away from launch

WORLD

8. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
9. Campaign 2018: These hacking groups could target the 2018 midterm elections
10. Top 5 ThreatConnect Resources for Malware Analysis
11. Cyber Fraud Ring Used Phishing to Steal $4 Million, Alleged Leader Faces Charges
12. A Google security audit uncovered a glitch in Google+ that exposed data from nearly 500,000 accounts. Ping CTO West @baber
13. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
14. Thieves and Geeks: Russian and Chinese Hacking Communities
15. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
16. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
17. Rebound Orthopedics & Neurosurgery hacked; 2,800 records exposed
18. A @Google #SecurityAudit uncovered privacy flaws and potential exposure of #PersonalData, leading to API changes, the shutdown of #GooglePlus and
19. Security Vulnerabilities in US Weapons Systems
20. Don't make us pay compensation for employee data breach, Morrisons begs UK court
21. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
22. MuddyWater expands operations
23. Ubisoft Hit With DDoS Attack During The Launch of Assassin’s Creed: Odyssey
24. Magecart Hits Popular Customer Review Plugin
25. A #Google security audit uncovered a glitch in #GooglePlus that exposed data from nearly 500,000 accounts, causing the company to
26. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
27. '5,000 UK firms' financial details exposed in data breaches' http://www.cityam.com/264491/uk-business-emails-could-represent-major-cyber-security … @CityAM Read the full research report here:
28. Zero-day exploit (CVE-2018-8453) used in targeted attacks
29. My Health Record justifications 'kind of lame': Godwin
30. Shopper Approved, the new victim of the Magecart hacking group
31. Acorus Network protects enterprises and service providers from DDoS attacks

ATTACKS

32. Campaign 2018: These hacking groups could target the 2018 midterm elections
33. 4.5 Billion Records Stolen in Data Breaches in the First Six Months of 2018
34. “You have 48 hours after reading this letter”– How to Identify the Latest Phishing Scam
35. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
36. Google Restricts Android Apps From Accessing Your Personal Data
37. Triangulating Beyond the Hack: Stolen Records Just One Tool in a Comprehensive Kit
38. Cyber Fraud Ring Used Phishing to Steal $4 Million, Alleged Leader Faces Charges
39. #NetSpectre exploits leak data remotely via side-channel attacks. Learn how to use #ThreatModeling to stop speculative execution from expert Ed
40. A Google security audit uncovered a glitch in Google+ that exposed data from nearly 500,000 accounts. Ping CTO West @baber
41. Innovative Phishing Tactic Makes Inroads Using Azure Blob
42. Razer Phone 2 leaks hours before announcement: wireless charging and IP67 water resistance
43. Goodbye Google Plus – Google Plans Google+ Shut Down After Data Breach
44. The #TLBleed vulnerability uses @Intel's HTT chip feature to leak data. Learn about how hackers could use #malware to launch
45. New state-backed espionage campaign targets military and government using freely available hacking tools
46. Follow @PhishingAi to stay up to date on #phishing attacks and trends!
47. Flaw in Ghostscript sandbox allowed system compromise
48. Emerging threat: password stuffing explained
49. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
50. Leaks suggest Samsung is working on a mid-range smartphone with four cameras
51. Rebound Orthopedics & Neurosurgery hacked; 2,800 records exposed
52. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials are openly
53. The spearphishing email contained a zip folder with a custom-built remote access trojan (RAT). Once executed, it would connect back to
54. Hackers can compromise your WhatsApp account by tricking you into answering a video call
55. Google+ API glitch exposed user profile data to developers
56. 291 records breached per second in first half of 2018
57. Hackers can use legitimate #AdminTools to compromise networks. Learn more about "living off the land" attacks from expert Michael Cobb
58. Don't make us pay compensation for employee data breach, Morrisons begs UK court
59. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
60. A $12 million case of business email compromise.
61. Microsoft WindowsCodecs.dll SniffAndConvertToWideString Information Leak Vulnerability
62. A #Google security audit uncovered a glitch in #GooglePlus that exposed data from nearly 500,000 accounts, causing the company to
63. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan
64. '5,000 UK firms' financial details exposed in data breaches' http://www.cityam.com/264491/uk-business-emails-could-represent-major-cyber-security … @CityAM Read the full research report here:
65. New Phishing Campaign Drops Ursnif into Conversation Threads
66. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
67. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
68. Leak reveals Google's Chinese search engine is months away from launch
69. PHASE 2 - INITIAL INTRUSION Number One decides it is time to launch a targeted spearphishing campaign. Through the newsletter, he learns
70. My Health Record justifications 'kind of lame': Godwin
71. Just Answering A Video Call Could Compromise Your WhatsApp Account
72. Acorus Network protects enterprises and service providers from DDoS attacks
73. Zero trust security: 5 reasons it’s not just about passwords
74. .@Google Firebase #DatabaseSecurity proved insufficient when bypassed by hackers to leak data. Learn more about this #SecurityFlaw from expert Michael

THREATS

75. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
76. Decrypting GandCrab Ransomware
77. CCSP Domain 4: Cloud Application Security
78. CCSP Domain 3: Cloud Platform and Infrastructure Security
79. FruityArmor APT Exploits Yet Another Windows Graphics Kernel Flaw
80. CCSP Domain 2: Cloud Data Security
81. CCSP Domain 1: Architectural Concepts & Design Requirements
82. The CAP Exam: Application Process, Rules and Eligibility, Exam Length and More
83. #ISC2Congress: The Promise of Blockchain
84. Top 5 ThreatConnect Resources for Malware Analysis
85. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
86. WhatsApp Fixes Vulnerability That’s Triggered by Answering a Call.
87. Cryptomining replaces ransomware as 2018's top cybersecurity threat
88. WhatsApp fixes video call bug that could have let hackers in, says report
89. KeyBoy Abuses Popular Office Exploits for Malware Delivery
90. Microsoft Added Severity Levels to Feedback Hub Bug Reports for Windows 10
91. Vulnerabilities found in Intel Unified Shader compiler
92. Malware 101: How Malware Avoids Static Detection Techniques
93. The #TLBleed vulnerability uses @Intel's HTT chip feature to leak data. Learn about how hackers could use #malware to launch
94. CSEU 2018: Nato grappling with implications of cyberspace as domain of warfare
95. Flaw in Ghostscript sandbox allowed system compromise
96. Four Critical Flaws Patched in Adobe Digital Edition
97. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
98. SAP Patches Critical Vulnerability in BusinessObjects
99. Symantec reveals state-sponsored group that doesn’t care for malware
100. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
101. Stegware: How is #malware using #steganography techniques to avoid detection?
102. A @Google #SecurityAudit uncovered privacy flaws and potential exposure of #PersonalData, leading to API changes, the shutdown of #GooglePlus and
103. The spearphishing email contained a zip folder with a custom-built remote access trojan (RAT). Once executed, it would connect back to
104. #Shodan can be a helpful tool for security professionals to locate #ICSsecurity vulnerabilities. Expert Ernie Hayden explains how Shodan works
105. Security Vulnerabilities in US Weapons Systems
106. Microsoft Patch Tuesday update covers zero-day, 12 critical issues
107. Many Siemens Products Affected by Foreshadow Vulnerabilities
108. A remote access #Trojan -- dubbed #GravityRAT -- was discovered by Cisco Talos (@TalosSecurity) to be checking for #antimalware sandboxes.
109. Microsoft has fixed the Windows 10 October Update data deletion bug
110. Gallmaker: New Attack Group Eschews Malware to Live off the Land
111. It's October 2018, and Exchange can be pwned by an 8 year-old... bug
112. Adobe security update fixes a handful of critical bugs, ignores Flash Player
113. .@FBI, @DHSgov call on users to mitigate #RemoteDesktop Protocol vulnerabilities and handle RDP exploits on their own, even as the
114. October 2018 Patch Tuesday: Microsoft fixes 49 flaws, one APT-wielded zero-day
115. Microsoft WindowsCodecs.dll SniffAndConvertToWideString Information Leak Vulnerability
116. Adobe October Security Update fixes 20 security flaws
117. Apple Released Security Updates for iOS 12.0.1 & iCloud with the Fixes for 21 Vulnerabilities
118. Google+ to shut down due to lack of adoption and privacy bug
119. Microsoft Fixes Zero Day and Data Deletion Bugs
120. Why Apple must be looking into using blockchain
121. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan
122. Zero-day exploit (CVE-2018-8453) used in targeted attacks
123. Windows Zero-Day Exploited in Attacks Aimed at Middle East
124. Bug bounties not a silver bullet, Katie Moussouris warns
125. Microsoft Released Security Updates & Fixed 49 Vulnerabilities that Affected Microsoft Products
126. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
127. October Patch Tuesday: Microsoft Repairs JET Database Engine Bug, Win32K EoP Zero-Day
128. Port of San Diego Hit by a Ransomware Attack Affecting its Computer Systems
129. Old-School Malware Tricks Still Work
130. "Creation of complex malware and organisation of multi-layered targeted attacks has shifted from financially motivated cyber-criminals to state-sponsored threat actors"
131. Hacker steals over $30k USD in cryptocurrency of SpankChain
132. WhatsApp fixes bug that let hackers take over app when answering a video call
133. At the 2018 @RSAConference, researchers discussed the rise of stegware -- #malware that uses #steganography techniques to avoid detection. Learn

CRIME

134. Rapidly Evolving Ransomware GandCrab Version 5 Partners With Crypter Service for Obfuscation
135. #ISC2Congress: The Promise of Blockchain
136. 4.5 Billion Records Stolen in Data Breaches in the First Six Months of 2018
137. “You have 48 hours after reading this letter”– How to Identify the Latest Phishing Scam
138. Threat Actors Prey on Drupalgeddon Vulnerability to Mass-Compromise Websites and Underlying Servers
139. Triangulating Beyond the Hack: Stolen Records Just One Tool in a Comprehensive Kit
140. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
141. Thieves and Geeks: Russian and Chinese Hacking Communities
142. New Threat Insight research: German-language threats span #phishing, BEC, #malware, and more...
143. Business email compromise made easy for #cybercriminals as 12.5 million company email boxes and 33,000 finance department credentials are openly
144. Payment-card-skimming Magecart strikes again: Zero out of five for infecting e-retail sites
145. Don't make us pay compensation for employee data breach, Morrisons begs UK court
146. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
147. A $12 million case of business email compromise.
148. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
149. Old-School Malware Tricks Still Work
150. "Creation of complex malware and organisation of multi-layered targeted attacks has shifted from financially motivated cyber-criminals to state-sponsored threat actors"
151. Hacker steals over $30k USD in cryptocurrency of SpankChain
152. Shopper Approved, the new victim of the Magecart hacking group
153. Acorus Network protects enterprises and service providers from DDoS attacks

POLITICS

154. Campaign 2018: These hacking groups could target the 2018 midterm elections
155. MuddyWater Threat Actor Expands Targets List
156. New state-backed espionage campaign targets military and government using freely available hacking tools
157. CSEU 2018: Nato grappling with implications of cyberspace as domain of warfare
158. The Many Faces of Necurs: How the Botnet Spewed Millions of Spam Emails for Cyber Extortion
159. Thieves and Geeks: Russian and Chinese Hacking Communities
160. CVE-2018-8453 Zero-Day flaw exploited by FruityArmor APT in attacks aimed at Middle East
161. Symantec reveals state-sponsored group that doesn’t care for malware
162. Hackers can compromise your WhatsApp account by tricking you into answering a video call
163. Gallmaker: New Attack Group Eschews Malware to Live off the Land
164. WTB: Phishing Attack Uses Azure Blob Storage To Impersonate Microsoft
165. MuddyWater expands operations
166. Group-IB: $49.4 million of damage caused to Russia’s financial sector from cyber attacks
167. California state primaries put spotlight on election campaign vulnerabilities #cybersecurity @5ean5ullivan

APT report for 2018-10-09

TRANSNATIONAL / UNKNOWN

1. Magecart Group Targets Shopper Approved in Latest Attack
2. The Magecart Seal of Approval: Card-Skimming Group Executes Scaled Supply Chain Attack on Shopper Approved
3. Magecart group compromises customer ratings tool, affecting 'hundreds' of online stores
4. New Magecart hack detected at Shopper Approved
5. Formjacking attacks are on the rise, with the recent #Magecart attacks the most notable examples. @Symantec has blocked almost 250,000
6. Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake

CHINA

7. DHS issued an alert on attacks aimed at Managed Service Providers

INDIA

Nil

NORTH KOREA

8. Remote robbery, an ‘IT incident’ (not a breach?), and face-off on privacy
9. Comienza en Moscú #CyberCrimeCon —el gran encuentro mundial sobre cibercrimen y ciberterrorismo— y de lo primero que hablan es de

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

10. APT28 group return to covert intelligence gathering ops in Europe and South America.

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-10-09

WINDOWS

1. Microsoft patches 0-day Windows flaw under attack
2. Microsoft Patches Windows Zero-Day Exploited by 'FruityArmor' Group
3. Microsoft October 2018 Patch Tuesday Fixes 12 Critical Vulnerabilities
4. Apple fixes iOS 12 passcode bypass vulnerabilities
5. Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads
6. Microsoft October Patch Tuesday Fixes 12 Critical Vulnerabilities
7. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
8. Phishing attacks use Azure Blob storage to simulate Microsoft
9. TOP 10 PHP Vulnerability Scanners

LINUX

10. Microsoft Patch Tuesday — October 18: Vulnerability disclosures and Snort coverage
11. New IoT botnet “hide and seek” variants target Android devices

UNIX

Nil

ANDROID

12. The end of Google+: Low usage and an API bug that exposed user data
13. New IoT botnet “hide and seek” variants target Android devices

IOS

14. Apple fixes iOS 12 passcode bypass vulnerabilities

MACOS

Nil