APT report for 2018-09-28

TRANSNATIONAL / UNKNOWN

1. Magecart campaign remains active

CHINA

Nothing to report

INDIA

Nothing to report

NORTH KOREA

Nothing to report

PAKISTAN

Nothing to report

VIETNAM

Nothing to report

IRAN

Nothing to report

LEBANON

Nothing to report

PALESTINE

Nothing to report

SAUDI ARABIA

Nothing to report

UNITED ARAB EMIRATES

Nothing to report

RUSSIA

2. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
3. Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
4. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
5. Fancy Bear still Putin out new modules for VPNFilter malware
6. Google first confirmed the existence of the Dragonfly program for returning to China

UKRAINE

Nothing to report

Platform report for 2018-09-28

WINDOWS

1. Vulnerabilities in PureVPN Client Leak User Credentials
2. Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
3. Windows 10 security: Here's how we're hitting back at fileless malware, says Microsoft
4. Microsoft is trying to kill passwords in Azure AD application

LINUX

5. Another Linux Kernel Bug Surfaces, Allowing Root Access
6. 'Mutagen Astronomy' Linux kernel vulnerability sighted
7. CVE-2018-1718 -Google Project Zero reports a new Linux Kernel flaw
8. Google Project Zero Discloses New Linux Kernel Flaw
9. Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit

UNIX

Nothing to report

ANDROID

10. Another Linux Kernel Bug Surfaces, Allowing Root Access
11. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
12. Android App Verification Issues Pave Way For Phishing Attacks
13. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
14. Hide 'N Seek IoT Botnet Now Targets Android Devices
15. Android password managers vulnerable to phishing apps
16. Android password managers not as secure as desktop counterparts
17. CVE-2018-1718 -Google Project Zero reports a new Linux Kernel flaw
18. Google Play Store Swarmed with Malware
19. Google first confirmed the existence of the Dragonfly program for returning to China

IOS

Nothing to report

MACOS

Nothing to report

Threat report for 2018-09-28

DATA BREACH

1. Facebook leaks data (including private conversations) from 50 million accounts
2. Facebook leaks data (including private conversations) from 50 million accounts
3. Facebook hacked – 50 Million Users’ Data exposed in the security breach
4. Big Facebook data breach: 50 million accounts affected
5. Facebook Data Breach Impacts Almost 50 Million Accounts
6. Vulnerabilities in PureVPN Client Leak User Credentials
7. New Phishing Campaign Targets US Employees' Online Payrolls
8. 3 GOP senators doxed during Kavanaugh hearing
9. Chegg Resets Passwords After Data Breach That Affected 40 Million Users
10. Facebook Discloses Data Breach, 50 Million User Accounts Affected
11. United Nations data found exposed on web: researcher
12. Magecart campaign remains active
13. “Firefox Monitor” will allow users to check whether their personal information and passwords have been part of a data breach
14. Bupa fined £175,000 for 2017 data breach affecting 547,000 customers
15. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
16. United Nations data found exposed on web: researcher
17. How can live chat widgets leak personal employee data?
18. Chegg Data Breach Affects 40 Million Customers

DENIAL-OF-SERVICE

19. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
20. Torii malware could be gateway to more sophisticated IoT botnet attacks
21. Meet Torii, a Stealthy, Versatile and Highly Persistent IoT Botnet
22. Hide 'N Seek IoT Botnet Now Targets Android Devices
23. Who’s behind DDoS attacks at UK universities?
24. Stealthy and Persistent Torii IoT Botnet Infects Devices via Telnet
25. Meet Torii, a new IoT botnet far more sophisticated than Mirai variants
26. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai
27. Phorpiex bots target remote access servers to deliver ransomware
28. New Iot Botnet Torii Uses Six Methods for Persistence, Has No Clear Purpose
29. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai

MALVERTISING

Nothing to report

PHISHING

30. Aspire Health, Another Healthcare Firm as a Phishing Victim
31. New Phishing Campaign Targets US Employees' Online Payrolls
32. Learn how our @PhishingAI successfully detected a custom #phishing kit targeted at the DNC last month:
33. Chegg forces password reset on 40 million users
34. SHEIN breach exposes emails, encrypted passwords of 6.42M customers
35. Do you know the top myths and facts of #mobile #phishing? If not, don't worry, we've compiled a list of
36. Android App Verification Issues Pave Way For Phishing Attacks
37. Facebook Resets 90 Million User Passwords as Flaw is Discovered
38. Facebook Resets 90 Million User Passwords as Flaw is Discovered
39. Chegg Resets Passwords After Data Breach That Affected 40 Million Users
40. Android password managers vulnerable to phishing apps
41. “Firefox Monitor” will allow users to check whether their personal information and passwords have been part of a data breach
42. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
43. Power to the people! Google backtracks (a bit) on forced Chrome logins
44. Microsoft is trying to kill passwords in Azure AD application
45. Android password managers not as secure as desktop counterparts
46. 7 Most Prevalent Phishing Subject Lines

WEB DEFACEMENT

Nothing to report

MALWARE

47. Port of San Diego suffers ransomware attack | Avast
48. Port of San Diego suffers ransomware attack | Avast
49. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
50. Zoho Was Blacklisted by Domain Registrar TierraNet
51. The Week in Ransomware - September 28th 2018 - RDP and gandCrab
52. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
53. 'Torii' Breaks New Ground For IoT Malware
54. Port of San Diego, The Newest Victim of Ransomware Attack
55. Powerful Ransomware Attack Hit on Port of San Diego
56. Torii malware could be gateway to more sophisticated IoT botnet attacks
57. Docs reveal how Fruitfly Mac spyware initially spread
58. Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
59. FBI solves mystery surrounding 15-year-old Fruitfly Mac malware
60. USB malware and cryptominers are threat to emerging markets
61. Potential Misuse of Legitimate Websites to Avoid Malware Detection
62. Port of San Diego Suffers Ransomware Attack
63. Delphi Packer Increasingly Used to Evade Malware Classification
64. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
65. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
66. Port of San Diego Hit by Ransomware
67. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
68. Windows 10 security: Here's how we're hitting back at fileless malware, says Microsoft
69. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)
70. Sunny Cali goes ballistic, this ransomware is atrocious. Even our IT bill will be something quite ferocious
71. Fancy Bear still Putin out new modules for VPNFilter malware
72. How Data Security Improves When You Engage Employees in the Process
73. Users Clicking Through Warnings, Leading to RAT Infections
74. Google Play Store Swarmed with Malware
75. Phorpiex bots target remote access servers to deliver ransomware
76. Port of San Diego Suffers Ransomware Attack
77. ICS Cybersecurity: Visibility, Protective Controls & Continuous Monitoring
78. ICS Cybersecurity: Visibility, Protective Controls & Continuous Monitoring

EXPLOIT

79. Tripwire Patch Priority Index for September 2018
80. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
81. Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit

VULNERABILITY

82. CVE-2018-11776 RCE Flaw in Apache Struts Could Be Root Cause of Clamorous Hacks
83. Critical Security Vulnerability in Facebook Affects 50 million Users!
84. Facebook Security Bug Affects 90M Users
85. [SingCERT] Alert on 14 High-Severity Vulnerabilities in Cisco Products
86. Another Linux Kernel Bug Surfaces, Allowing Root Access
87. Vulnerabilities in PureVPN Client Leak User Credentials
88. FBI IC3 Warns of RDP Vulnerability
89. Facebook Vulnerability Affecting 50 Million Users Allowed Account Takeover
90. Facebook Resets 90 Million User Passwords as Flaw is Discovered
91. Facebook Resets 90 Million User Passwords as Flaw is Discovered
92. Hackers Stole 50 Million Facebook Users' Access Tokens Using Zero-Day Flaw
93. Researchers: 11-Year-Old Flaw in Vote Scanner Still Unfixed
94. Facebook: 50 million accounts impacted by security flaw
95. 'Mutagen Astronomy' Linux kernel vulnerability sighted
96. SECURITY UPDATE: Facebook said a breach affected 50 million people on the social network. The vulnerability stemmed from Facebook's "View As"
97. Connected car cyber-security getting better, fewer critical vulnerabilities found
98. No Patches for Critical Flaws in Fuji Electric Servo System, Drives
99. CVE-2018-1718 -Google Project Zero reports a new Linux Kernel flaw
100. Vulnerabilities and architectural considerations in industrial control systems
101. Google Project Zero Discloses New Linux Kernel Flaw
102. Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit
103. Tripwire Patch Priority Index for September 2018

Region brief for 2018-09-28

ASIA

1. No Patches for Critical Flaws in Fuji Electric Servo System, Drives
2. Google first confirmed the existence of the Dragonfly program for returning to China

OCEANIA

Nothing to report

NORTH AMERICA

3. Facebook leaks data (including private conversations) from 50 million accounts
4. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
5. Aspire Health, Another Healthcare Firm as a Phishing Victim
6. New Phishing Campaign Targets US Employees' Online Payrolls
7. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
8. Researchers: 11-Year-Old Flaw in Vote Scanner Still Unfixed
9. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
10. Vulnerabilities and architectural considerations in industrial control systems

SOUTH AMERICA

Nothing to report

EUROPE

11. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
12. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
13. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
14. Magecart campaign remains active
15. Who’s behind DDoS attacks at UK universities?
16. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)

AFRICA

Nothing to report

Sector brief for 2018-09-28

HEALTHCARE

1. Aspire Health, Another Healthcare Firm as a Phishing Victim
2. New Phishing Campaign Targets US Employees' Online Payrolls

TRANSPORT

3. Port of San Diego suffers ransomware attack | Avast
4. Port of San Diego suffers ransomware attack | Avast
5. Port of San Diego, The Newest Victim of Ransomware Attack
6. Powerful Ransomware Attack Hit on Port of San Diego
7. Port of San Diego Suffers Ransomware Attack
8. Port of San Diego Hit by Ransomware
9. Port of San Diego Suffers Ransomware Attack

BANKING & FINANCE

10. New Phishing Campaign Targets US Employees' Online Payrolls
11. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
12. Magecart campaign remains active

INFORMATION & TELECOMMUNICATION

Nothing to report

FOOD

Nothing to report

WATER

Nothing to report

ENERGY

Nothing to report

GOVERNMENT & PUBLIC SERVICE

13. Facebook leaks data (including private conversations) from 50 million accounts
14. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
15. New Phishing Campaign Targets US Employees' Online Payrolls

Daily brief for 2018-09-28

ASIA

1. No Patches for Critical Flaws in Fuji Electric Servo System, Drives
2. Google first confirmed the existence of the Dragonfly program for returning to China

WORLD

3. Facebook leaks data (including private conversations) from 50 million accounts
4. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
5. Aspire Health, Another Healthcare Firm as a Phishing Victim
6. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
7. New Phishing Campaign Targets US Employees' Online Payrolls
8. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
9. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
10. Magecart campaign remains active
11. Researchers: 11-Year-Old Flaw in Vote Scanner Still Unfixed
12. Who’s behind DDoS attacks at UK universities?
13. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
14. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)
15. Vulnerabilities and architectural considerations in industrial control systems

ATTACKS

16. Facebook leaks data (including private conversations) from 50 million accounts
17. Facebook leaks data (including private conversations) from 50 million accounts
18. Facebook hacked – 50 Million Users’ Data exposed in the security breach
19. Big Facebook data breach: 50 million accounts affected
20. Facebook Data Breach Impacts Almost 50 Million Accounts
21. Vulnerabilities in PureVPN Client Leak User Credentials
22. Aspire Health, Another Healthcare Firm as a Phishing Victim
23. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
24. New Phishing Campaign Targets US Employees' Online Payrolls
25. Learn how our @PhishingAI successfully detected a custom #phishing kit targeted at the DNC last month:
26. 3 GOP senators doxed during Kavanaugh hearing
27. Chegg forces password reset on 40 million users
28. Torii malware could be gateway to more sophisticated IoT botnet attacks
29. SHEIN breach exposes emails, encrypted passwords of 6.42M customers
30. Do you know the top myths and facts of #mobile #phishing? If not, don't worry, we've compiled a list of
31. Android App Verification Issues Pave Way For Phishing Attacks
32. Facebook Resets 90 Million User Passwords as Flaw is Discovered
33. Facebook Resets 90 Million User Passwords as Flaw is Discovered
34. Meet Torii, a Stealthy, Versatile and Highly Persistent IoT Botnet
35. Chegg Resets Passwords After Data Breach That Affected 40 Million Users
36. Facebook Discloses Data Breach, 50 Million User Accounts Affected
37. United Nations data found exposed on web: researcher
38. Hide 'N Seek IoT Botnet Now Targets Android Devices
39. Magecart campaign remains active
40. Android password managers vulnerable to phishing apps
41. “Firefox Monitor” will allow users to check whether their personal information and passwords have been part of a data breach
42. Bupa fined £175,000 for 2017 data breach affecting 547,000 customers
43. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
44. Power to the people! Google backtracks (a bit) on forced Chrome logins
45. Who’s behind DDoS attacks at UK universities?
46. Microsoft is trying to kill passwords in Azure AD application
47. Android password managers not as secure as desktop counterparts
48. Stealthy and Persistent Torii IoT Botnet Infects Devices via Telnet
49. United Nations data found exposed on web: researcher
50. Meet Torii, a new IoT botnet far more sophisticated than Mirai variants
51. How can live chat widgets leak personal employee data?
52. Chegg Data Breach Affects 40 Million Customers
53. 7 Most Prevalent Phishing Subject Lines
54. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai
55. Phorpiex bots target remote access servers to deliver ransomware
56. New Iot Botnet Torii Uses Six Methods for Persistence, Has No Clear Purpose
57. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai

THREATS

58. CVE-2018-11776 RCE Flaw in Apache Struts Could Be Root Cause of Clamorous Hacks
59. Port of San Diego suffers ransomware attack | Avast
60. Port of San Diego suffers ransomware attack | Avast
61. Critical Security Vulnerability in Facebook Affects 50 million Users!
62. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
63. Facebook Security Bug Affects 90M Users
64. Zoho Was Blacklisted by Domain Registrar TierraNet
65. [SingCERT] Alert on 14 High-Severity Vulnerabilities in Cisco Products
66. Another Linux Kernel Bug Surfaces, Allowing Root Access
67. Vulnerabilities in PureVPN Client Leak User Credentials
68. The Week in Ransomware - September 28th 2018 - RDP and gandCrab
69. 7 new modules for VPNFilter malware, Hide & Seek botnet targets Android, and house oversight takes on AI | Avast
70. 'Torii' Breaks New Ground For IoT Malware
71. FBI IC3 Warns of RDP Vulnerability
72. Tripwire Patch Priority Index for September 2018
73. Port of San Diego, The Newest Victim of Ransomware Attack
74. Powerful Ransomware Attack Hit on Port of San Diego
75. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
76. Torii malware could be gateway to more sophisticated IoT botnet attacks
77. Docs reveal how Fruitfly Mac spyware initially spread
78. Facebook Vulnerability Affecting 50 Million Users Allowed Account Takeover
79. Fancy Bear’s Lojax is First UEFI Rootkit in the Wild
80. FBI solves mystery surrounding 15-year-old Fruitfly Mac malware
81. USB malware and cryptominers are threat to emerging markets
82. Facebook Resets 90 Million User Passwords as Flaw is Discovered
83. Potential Misuse of Legitimate Websites to Avoid Malware Detection
84. Facebook Resets 90 Million User Passwords as Flaw is Discovered
85. Port of San Diego Suffers Ransomware Attack
86. Delphi Packer Increasingly Used to Evade Malware Classification
87. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
88. Hackers Stole 50 Million Facebook Users' Access Tokens Using Zero-Day Flaw
89. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
90. Researchers: 11-Year-Old Flaw in Vote Scanner Still Unfixed
91. Port of San Diego Hit by Ransomware
92. Facebook: 50 million accounts impacted by security flaw
93. Fancy Bear Attacks Governments Using LoJax UEFI Rootkit
94. Windows 10 security: Here's how we're hitting back at fileless malware, says Microsoft
95. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)
96. Sunny Cali goes ballistic, this ransomware is atrocious. Even our IT bill will be something quite ferocious
97. Fancy Bear still Putin out new modules for VPNFilter malware
98. 'Mutagen Astronomy' Linux kernel vulnerability sighted
99. How Data Security Improves When You Engage Employees in the Process
100. SECURITY UPDATE: Facebook said a breach affected 50 million people on the social network. The vulnerability stemmed from Facebook's "View As"
101. Connected car cyber-security getting better, fewer critical vulnerabilities found
102. Users Clicking Through Warnings, Leading to RAT Infections
103. No Patches for Critical Flaws in Fuji Electric Servo System, Drives
104. CVE-2018-1718 -Google Project Zero reports a new Linux Kernel flaw
105. Google Play Store Swarmed with Malware
106. Phorpiex bots target remote access servers to deliver ransomware
107. Vulnerabilities and architectural considerations in industrial control systems
108. Google Project Zero Discloses New Linux Kernel Flaw
109. Port of San Diego Suffers Ransomware Attack
110. ICS Cybersecurity: Visibility, Protective Controls & Continuous Monitoring
111. Google Hacker Discloses New Linux Kernel Vulnerability and PoC Exploit
112. Tripwire Patch Priority Index for September 2018
113. ICS Cybersecurity: Visibility, Protective Controls & Continuous Monitoring

CRIME

114. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
115. Aspire Health, Another Healthcare Firm as a Phishing Victim
116. New Phishing Campaign Targets US Employees' Online Payrolls
117. IC3 Alerts of Increasing Danger of RDP Exploitation Attacks
118. Potential Misuse of Legitimate Websites to Avoid Malware Detection
119. QRecorder app in the Play Store was hiding a Banking Trojan that targets European banks
120. Magecart campaign remains active
121. The @ironscales #whitepaper explores how modern #phishing techniques, such as business email compromise (#BEC), #ransomware, spear-phishing and advanced persistent threats
122. Stealthy and Persistent Torii IoT Botnet Infects Devices via Telnet

POLITICS

123. Facebook leaks data (including private conversations) from 50 million accounts
124. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
125. Aspire Health, Another Healthcare Firm as a Phishing Victim
126. Hackers Stole 50 Million Facebook Users' Access Tokens Using Zero-Day Flaw
127. Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)

APT report for 2018-09-27

TRANSNATIONAL / UNKNOWN

1. Threat-group Magecart - More Victims
2. Europol Highlights Continued Threats, but Magecart Demands Focus on Web Security

CHINA

3. APT10 Targeting Japanese Corporations Using Updated TTPs

INDIA

Nothing to report

NORTH KOREA

Nothing to report

PAKISTAN

Nothing to report

VIETNAM

Nothing to report

IRAN

Nothing to report

LEBANON

Nothing to report

PALESTINE

Nothing to report

SAUDI ARABIA

Nothing to report

UNITED ARAB EMIRATES

Nothing to report

RUSSIA

4. APT Group Uses Dangerous LoJax Malware That Can Survive After OS Re-installation and Hard Disk Replacement
5. Russians' stealthy 'LoJax' malware can infect on the firmware level
6. Seven additional modules make Fancy Bear’s VPNFilter malware even more versatile
7. Russian Cyberspies Use UEFI Rootkit in Attacks
8. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
9. LoJax: First-ever UEFI rootkit detected in a cyberattack
10. Cybersecurity Researchers Spotted First-Ever UEFI Rootkit in the Wild
11. Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild
12. Seven additional modules make Fancy Bear's VPNFilter malware even more versatile
13. APT28 Uses LoJax, First UEFI Rootkit Seen in the Wild
14. VPNFilter Router Malware Adds 7 New Network Exploitation Modules
15. “Disturbing plans” in China revealed by a former Google employee

UKRAINE

Nothing to report

Platform report for 2018-09-27

WINDOWS

1. The PowerShell Boogeyman: How to Defend Against Malicious PowerShell Attacks
2. Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
3. Is There Such a Thing as a Malicious PowerShell Command?

LINUX

4. Local-Privilege Escalation Flaw in Linux Kernel Allows Root Access
5. Cisco unearths 13 'High Impact' IOS vulnerabilities you need to patch now
6. Mutagen Astronomy Linux Kernel vulnerability affects Red Hat, CentOS, and Debian distros

UNIX

Nothing to report

ANDROID

7. Hide and Seek (HNS) IoT Botnet targets Android devices with ADB option enabled
8. Android password managers not as secure as desktop counterparts
9. Hide and seek Iot botnet updates include new Android ADB exploit
10. Hide and seek Iot botnet updates include new Android ADB exploit

IOS

11. Cisco unearths 13 'High Impact' IOS vulnerabilities you need to patch now

MACOS

12. ex-NSA Hacker Discloses macOS Mojave 10.14 Zero-Day Vulnerability

Threat report for 2018-09-27

DATA BREACH

1. Twitter Bug May Have Exposed Millions of DMs
2. GDPR: Data Breach Class Action Lawsuits Come to Europe
3. Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild
4. SheIn Data Breach Exposed Personal Details 6.4 Million Customers To Hackers
5. United Nations data found exposed on web: researcher
6. New GootKit Campaigns Target European Banks with Reconnaissance Attacks
7. Uber to Pay $148 Million as a Settlement for Data Breach Cover
8. Uber fined $148m for data breach cover-up
9. You should prepare for the next mega data breach
10. Uber agrees to pay $148 million in massive 2016 data breach settlement
11. Endace launches petabyte network recording appliance

DENIAL-OF-SERVICE

12. Hide and Seek (HNS) IoT Botnet targets Android devices with ADB option enabled
13. Hide and seek Iot botnet updates include new Android ADB exploit
14. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai
15. DDoS attack on education vendor hinders access to districts’ online portals
16. New Torii Botnet uncovered, more sophisticated than Mirai | Avast
17. Hide and seek Iot botnet updates include new Android ADB exploit
18. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai

MALVERTISING

Nothing to report

PHISHING

19. Android password managers not as secure as desktop counterparts
20. Boffins bypass password protection with pilfering by phony programs
21. Are long passphrases the answer to password problems?
22. Chrome 70 will resolve cookies and login privacy issues

WEB DEFACEMENT

Nothing to report

MALWARE

23. APT Group Uses Dangerous LoJax Malware That Can Survive After OS Re-installation and Hard Disk Replacement
24. Russians' stealthy 'LoJax' malware can infect on the firmware level
25. CCSP Exam Details and Process
26. CCSP: Overview of Domains
27. Ransomware Attack Hits Port of San Diego
28. The PowerShell Boogeyman: How to Defend Against Malicious PowerShell Attacks
29. Chronicle Unveils VirusTotal Enterprise
30. Crooks turn to Delphi packers to evade malware detection
31. Chronicle announces VirusTotal Enterprise with greater search and analysis capabilities
32. Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
33. Alphabet launches VirusTotal Enterprise
34. Is There Such a Thing as a Malicious PowerShell Command?
35. New KONNI Malware attacking Eurasia and Southeast Asia
36. New KONNI Malware attacking Eurasia and Southeast Asia
37. Pirated Game of Thrones episodes most popular TV bait for malware
38. Seven additional modules make Fancy Bear’s VPNFilter malware even more versatile
39. Russian Cyberspies Use UEFI Rootkit in Attacks
40. Dirhunt – Search and Analyze Target Domain Directories
41. Port of San Diego Affected by a Ransomware Attack
42. Phorpiex worm pivots to infect the enterprise with GandCrab ransomware
43. Crooks turn to Delphi packers to evade malware detection
44. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
45. LoJax: First-ever UEFI rootkit detected in a cyberattack
46. DanaBot trojan sets sights on Europe, new features
47. SC Media September Product Reviews: Threat Intelligence DomainTools Iris Investigation Platform l
48. #Malware classifcation, which encompasses both the identification and attribution of code, has the power to unlock many clues that aid
49. New VirusTotal Enterprise Offers Private Graphs, Faster Searches
50. Alphabet's Chronicle Releases VirusTotal Enterprise
51. Malware steals personal information from 6.4M SheIn customers
52. Malware hits fashion giant SHEIN; 6.42 million online shoppers affected
53. Cybersecurity Researchers Spotted First-Ever UEFI Rootkit in the Wild
54. Emergence of new ransomware variants feature names of popular politicians
55. Now that Office 365 has become one of Microsoft's fastest-growing revenue streams, it has become a primary target for #ransomware.
56. Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild
57. Researchers find vulnerability in Apple's MDM DEP process
58. Seven additional modules make Fancy Bear's VPNFilter malware even more versatile
59. Cloudflare Becomes a Registrar, Sells Domains At Cost
60. APT28 Uses LoJax, First UEFI Rootkit Seen in the Wild
61. Alphabet's Chronicle Security Business Launches VirusTotal Enterprise
62. VPNFilter Router Malware Adds 7 New Network Exploitation Modules
63. Malware in the Cloud: What You Need to Know
64. Discover how Tripwire Malware Detection... - Protects against zero-day exploits and other known threats. - Offers an enterprise view of suspicious malware objects across all monitored systems. - Protects from repeat #malware attacks. Learn more here:
65. Malware in the Cloud: What You Need to Know

EXPLOIT

66. Hide and seek Iot botnet updates include new Android ADB exploit
67. Hide and seek Iot botnet updates include new Android ADB exploit
68. VPNFilter Router Malware Adds 7 New Network Exploitation Modules
69. Discover how Tripwire Malware Detection... - Protects against zero-day exploits and other known threats. - Offers an enterprise view of suspicious malware objects across all monitored systems. - Protects from repeat #malware attacks. Learn more here:

VULNERABILITY

70. Local-Privilege Escalation Flaw in Linux Kernel Allows Root Access
71. DEF CON report finds decade-old flaw in widely used ballot-counting machine
72. Twitter fixes API bug that shared data with wrong developers
73. How to Keep Up Security in a Bug-Infested World
74. Twitter Bug May Have Exposed Millions of DMs
75. Developers focus on wrong open source software vulnerabilities, research says
76. Security Flaw Found in Apple Mobile Device Enrollment Program
77. Cisco Releases Alerts for 14 High Severity Bugs
78. Apple DEP vulnerability lets attackers access orgs’ resources, info
79. Cisco unearths 13 'High Impact' IOS vulnerabilities you need to patch now
80. How automakers are tackling connected vehicle vulnerability management
81. Tripwire Patch Priority Index for September 2018
82. Researchers find vulnerability in Apple's MDM DEP process
83. GNOME 3.30.1 released: bugfixes
84. Norwegian state discusses vulnerabilities with IT sector
85. Mutagen Astronomy Linux Kernel vulnerability affects Red Hat, CentOS, and Debian distros
86. KDE Plasma 5.12.7 LTS releases: fix bugs
87. Discover how Tripwire Malware Detection... - Protects against zero-day exploits and other known threats. - Offers an enterprise view of suspicious malware objects across all monitored systems. - Protects from repeat #malware attacks. Learn more here:
88. ex-NSA Hacker Discloses macOS Mojave 10.14 Zero-Day Vulnerability

Region brief for 2018-09-27

ASIA

1. APT10 Targeting Japanese Corporations Using Updated TTPs
2. New Torii Botnet uncovered, more sophisticated than Mirai | Avast
3. “Disturbing plans” in China revealed by a former Google employee

OCEANIA

Nothing to report

NORTH AMERICA

4. DEF CON report finds decade-old flaw in widely used ballot-counting machine
5. GDPR: Data Breach Class Action Lawsuits Come to Europe
6. SheIn Data Breach Exposed Personal Details 6.4 Million Customers To Hackers
7. You should prepare for the next mega data breach
8. Uber agrees to pay $148 million in massive 2016 data breach settlement
9. “Disturbing plans” in China revealed by a former Google employee

SOUTH AMERICA

Nothing to report

EUROPE

10. Russians' stealthy 'LoJax' malware can infect on the firmware level
11. Russian Cyberspies Use UEFI Rootkit in Attacks
12. Threat-group Magecart - More Victims
13. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
14. Norwegian state discusses vulnerabilities with IT sector
15. Seven additional modules make Fancy Bear's VPNFilter malware even more versatile
16. VPNFilter Router Malware Adds 7 New Network Exploitation Modules

AFRICA

Nothing to report

Sector brief for 2018-09-27

HEALTHCARE

Nothing to report

TRANSPORT

Nothing to report

BANKING & FINANCE

1. Threat-group Magecart - More Victims
2. New GootKit Campaigns Target European Banks with Reconnaissance Attacks

INFORMATION & TELECOMMUNICATION

Nothing to report

FOOD

Nothing to report

WATER

Nothing to report

ENERGY

Nothing to report

GOVERNMENT & PUBLIC SERVICE

3. DEF CON report finds decade-old flaw in widely used ballot-counting machine

Daily brief for 2018-09-27

ASIA

1. APT10 Targeting Japanese Corporations Using Updated TTPs
2. New Torii Botnet uncovered, more sophisticated than Mirai | Avast
3. “Disturbing plans” in China revealed by a former Google employee

WORLD

4. Russians' stealthy 'LoJax' malware can infect on the firmware level
5. DEF CON report finds decade-old flaw in widely used ballot-counting machine
6. Russian Cyberspies Use UEFI Rootkit in Attacks
7. Threat-group Magecart - More Victims
8. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
9. GDPR: Data Breach Class Action Lawsuits Come to Europe
10. SheIn Data Breach Exposed Personal Details 6.4 Million Customers To Hackers
11. Norwegian state discusses vulnerabilities with IT sector
12. Seven additional modules make Fancy Bear's VPNFilter malware even more versatile
13. You should prepare for the next mega data breach
14. Uber agrees to pay $148 million in massive 2016 data breach settlement
15. VPNFilter Router Malware Adds 7 New Network Exploitation Modules
16. “Disturbing plans” in China revealed by a former Google employee

ATTACKS

17. Hide and Seek (HNS) IoT Botnet targets Android devices with ADB option enabled
18. Android password managers not as secure as desktop counterparts
19. Hide and seek Iot botnet updates include new Android ADB exploit
20. Twitter Bug May Have Exposed Millions of DMs
21. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai
22. DDoS attack on education vendor hinders access to districts’ online portals
23. Boffins bypass password protection with pilfering by phony programs
24. GDPR: Data Breach Class Action Lawsuits Come to Europe
25. Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild
26. New Torii Botnet uncovered, more sophisticated than Mirai | Avast
27. SheIn Data Breach Exposed Personal Details 6.4 Million Customers To Hackers
28. Hide and seek Iot botnet updates include new Android ADB exploit
29. United Nations data found exposed on web: researcher
30. New GootKit Campaigns Target European Banks with Reconnaissance Attacks
31. Uber to Pay $148 Million as a Settlement for Data Breach Cover
32. Uber fined $148m for data breach cover-up
33. New "Torii" Botnet's Sophisticated Techniques Set It Apart From Mirai
34. You should prepare for the next mega data breach
35. Uber agrees to pay $148 million in massive 2016 data breach settlement
36. Are long passphrases the answer to password problems?
37. Chrome 70 will resolve cookies and login privacy issues
38. Endace launches petabyte network recording appliance

THREATS

39. APT Group Uses Dangerous LoJax Malware That Can Survive After OS Re-installation and Hard Disk Replacement
40. Russians' stealthy 'LoJax' malware can infect on the firmware level
41. CCSP Exam Details and Process
42. CCSP: Overview of Domains
43. Ransomware Attack Hits Port of San Diego
44. The PowerShell Boogeyman: How to Defend Against Malicious PowerShell Attacks
45. Chronicle Unveils VirusTotal Enterprise
46. Crooks turn to Delphi packers to evade malware detection
47. Chronicle announces VirusTotal Enterprise with greater search and analysis capabilities
48. Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
49. Local-Privilege Escalation Flaw in Linux Kernel Allows Root Access
50. Alphabet launches VirusTotal Enterprise
51. DEF CON report finds decade-old flaw in widely used ballot-counting machine
52. Twitter fixes API bug that shared data with wrong developers
53. Is There Such a Thing as a Malicious PowerShell Command?
54. New KONNI Malware attacking Eurasia and Southeast Asia
55. New KONNI Malware attacking Eurasia and Southeast Asia
56. How to Keep Up Security in a Bug-Infested World
57. Pirated Game of Thrones episodes most popular TV bait for malware
58. Seven additional modules make Fancy Bear’s VPNFilter malware even more versatile
59. Hide and seek Iot botnet updates include new Android ADB exploit
60. Twitter Bug May Have Exposed Millions of DMs
61. Russian Cyberspies Use UEFI Rootkit in Attacks
62. Dirhunt – Search and Analyze Target Domain Directories
63. Port of San Diego Affected by a Ransomware Attack
64. Developers focus on wrong open source software vulnerabilities, research says
65. Phorpiex worm pivots to infect the enterprise with GandCrab ransomware
66. Security Flaw Found in Apple Mobile Device Enrollment Program
67. Crooks turn to Delphi packers to evade malware detection
68. Russian Sednit APT used the first UEFI rootkit of ever in attacks in the wild
69. LoJax: First-ever UEFI rootkit detected in a cyberattack
70. DanaBot trojan sets sights on Europe, new features
71. SC Media September Product Reviews: Threat Intelligence DomainTools Iris Investigation Platform l
72. #Malware classifcation, which encompasses both the identification and attribution of code, has the power to unlock many clues that aid
73. New VirusTotal Enterprise Offers Private Graphs, Faster Searches
74. Alphabet's Chronicle Releases VirusTotal Enterprise
75. Cisco Releases Alerts for 14 High Severity Bugs
76. Apple DEP vulnerability lets attackers access orgs’ resources, info
77. Cisco unearths 13 'High Impact' IOS vulnerabilities you need to patch now
78. Malware steals personal information from 6.4M SheIn customers
79. How automakers are tackling connected vehicle vulnerability management
80. Malware hits fashion giant SHEIN; 6.42 million online shoppers affected
81. Cybersecurity Researchers Spotted First-Ever UEFI Rootkit in the Wild
82. Emergence of new ransomware variants feature names of popular politicians
83. Now that Office 365 has become one of Microsoft's fastest-growing revenue streams, it has become a primary target for #ransomware.
84. Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild
85. Tripwire Patch Priority Index for September 2018
86. Researchers find vulnerability in Apple's MDM DEP process
87. GNOME 3.30.1 released: bugfixes
88. Norwegian state discusses vulnerabilities with IT sector
89. Seven additional modules make Fancy Bear's VPNFilter malware even more versatile
90. Hide and seek Iot botnet updates include new Android ADB exploit
91. Cloudflare Becomes a Registrar, Sells Domains At Cost
92. APT28 Uses LoJax, First UEFI Rootkit Seen in the Wild
93. Mutagen Astronomy Linux Kernel vulnerability affects Red Hat, CentOS, and Debian distros
94. Alphabet's Chronicle Security Business Launches VirusTotal Enterprise
95. VPNFilter Router Malware Adds 7 New Network Exploitation Modules
96. Malware in the Cloud: What You Need to Know
97. KDE Plasma 5.12.7 LTS releases: fix bugs
98. Discover how Tripwire Malware Detection... - Protects against zero-day exploits and other known threats. - Offers an enterprise view of suspicious malware objects across all monitored systems. - Protects from repeat #malware attacks. Learn more here:
99. Malware in the Cloud: What You Need to Know
100. ex-NSA Hacker Discloses macOS Mojave 10.14 Zero-Day Vulnerability

CRIME

101. Russians' stealthy 'LoJax' malware can infect on the firmware level
102. Threat-group Magecart - More Victims
103. New GootKit Campaigns Target European Banks with Reconnaissance Attacks

POLITICS

104. DEF CON report finds decade-old flaw in widely used ballot-counting machine
105. Russian Cyberspies Use UEFI Rootkit in Attacks
106. APT10 Targeting Japanese Corporations Using Updated TTPs
107. APT28 Uses LoJax, First UEFI Rootkit Seen in the Wild