APT report for 2018-10-23

TRANSNATIONAL / UNKNOWN

1. Magecart group leverages zero-days in 20 Magento extensions
2. NSA Tools Used to Attack Nuclear Energy Firms
3. Hacking operations with DarkPulsar and other tools developed by the NSA

CHINA

4. Chinese Cyber Espionage Group using Datper Trojan

INDIA

Nil

NORTH KOREA

5. North Korean Hackers Stole $571 Million Worth of CryptoCoins in Less Than 24 Months

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

6. Experts advocate for 'ATT&CK' as go-to framework to share threat intel
7. FireEye links Russia-owned lab to Trisis developers

SERBIA

Nil

UKRAINE

8. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers

Platform report for 2018-10-23

WINDOWS

1. Microsoft Windows zero-day disclosed on Twitter, again
2. When Ransomware Stopped Working Harder and Started Working Smarter
3. Chalubo DDoS Botnet Compromises Linux SSH Servers Using Brute-Force Attacks
4. Bots Targeting SSH Servers and Brute-Forcing Entry
5. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers
6. NSA Tools Used to Attack Nuclear Energy Firms
7. Hacking operations with DarkPulsar and other tools developed by the NSA
8. Windows 10 1809 Zip Extraction Bug Overwrites Files without Confirmation

LINUX

9. Chalubo DDoS Botnet Compromises Linux SSH Servers Using Brute-Force Attacks
10. Bots Targeting SSH Servers and Brute-Forcing Entry

UNIX

Nil

ANDROID

Nil

IOS

11. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw
12. Apple has launched its university ID Cards feature in Wallet. Students at three universities can now access their student ID

MACOS

13. Inside Safari Extensions | Malicious Plugins Remain on Mojave
14. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw

Threat report for 2018-10-23

DATA BREACH & DATA LOSS

1. Case Study: Protecting PII
2. An ISP Left Corporate Passwords, Keys, and All its Data Exposed on the Internet
3. Top 10 security steps in Microsoft 365 that political campaigns can take today
4. Critical vulnerabilities in FreeRTOS allowed for IoT device compromise
5. Thousands of applications affected by a zero-day issue injQuery File Upload plugin
6. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
7. Identify when your data is exposed, your brand is abused, or your company is mentioned on the dark web. Test
8. Thousands of Applications Vulnerable to RCE via jQuery File Upload
9. Facebook has seen several data breaches in the last few months, leading the company to look into acquiring a
10. Police have issued a fresh warning concerning Fortnite and players giving out their personal details online. Cheshire Police posted on Facebook,
11. Adult websites shuttered after 1.2 million user details exposed
12. #sLoad and #Ramnit pairing in sustained personalized campaigns against UK and Italy
13. jQuery? More like preyQuery: File upload tool can be exploited to hijack at-risk websites
14. "Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
15. “We’re less likely to be caught up in a massive breach of highly available PII or financial data that gets
16. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
17. Morrisons loses appeal over data breach
18. Morrisons loses appeal against data breach liability ruling
19. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may

DENIAL-OF-SERVICE

20. DDoS-Capable IoT Botnet 'Chalubo' Rises
21. Chalubo DDoS Botnet Compromises Linux SSH Servers Using Brute-Force Attacks
22. Netscout Launches Arbor Edge Defense for Enterprise DDoS Security
23. Oracle Doubles Down on Cloud Security With CASB, WAF, DDoS Protection

MALVERTISING

Nil

PHISHING

24. Phishing is still the most commonly used attack on organizations, survey says
25. New Phishing Attack That Uses Multiple Replica Sign-In Pages
26. How sophisticated phishing grants attackers total control of your computer
27. How sophisticated phishing grants attackers total control of your computer
28. 5 Ways #Cybercriminals Can Access Your Emails Without Phishing [Infographic]:
29. Phishing attacks becoming more targeted, phishers love Microsoft the most
30. Learn how hackers launched #phishing attacks against @netflix users with expert Michael Cobb of @thehairyITdog
31. "Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
32. Phishing Report Shows Microsoft, Paypal, & Netflix as Top Targets
33. 4 suggerimenti per utilizzare al meglio il vostro #password manager e generare password davvero efficaci. Ebbene sì, repetita juvant :)

WEB DEFACEMENT

34. Hackers Defaced Davos In The Desert To Show Image Of Murdered Journalist
35. Saudi Investment Site Defaced After Journalist’s Murder

BOTNET

36. DDoS-Capable IoT Botnet 'Chalubo' Rises
37. Chalubo DDoS Botnet Compromises Linux SSH Servers Using Brute-Force Attacks
38. Battling Bots: How to Find Fake Twitter Followers
39. Bots Targeting SSH Servers and Brute-Forcing Entry

RANSOMWARE

40. When Ransomware Stopped Working Harder and Started Working Smarter
41. City Pays $2K in Ransomware, Stirs ‘Never Pay’ Debate
42. Case Study: Ransomware
43. Indiana National Guard Suffers Ransomware Attack
44. Indiana National Guard hit by ransomware
45. Have you ever wondered why #ransomware attacks happen on the Friday before a long weekend? We've teamed up with @SentinelOne

CRYPTOMINING & CRYPTOCURRENCIES

46. Why the blockchain is not secure
47. Trade.io Cold Wallet Hacked Losing 50 Million TIO Tokens – TIO Coin To Be Forked
48. Why is Elon Musk promoting this Bitcoin scam? (He’s not)
49. Report: Cryptocurrency hackers earned $20M with 51-percent attacks in 2018
50. Apple has launched its university ID Cards feature in Wallet. Students at three universities can now access their student ID
51. Can Cybercriminals Hack Blockchain?
52. A Beginner’s Guide to Bitcoin Mining (Bitcoin Mining 101)

MALWARE

53. Burned malware returns, according to Cylance: is Hacking Team responsible?
54. Status of Today’s Email as a Malware Vector
55. Case Study: Destructive Malware
56. Banking Trojan Infections Persist Throughout the State
57. Triton Malware Linked to Russian Government Research Institute
58. FireEye links Russian research lab to Triton ICS malware attacks
59. Securing Government Operations with Cloud-based Malware Analysis
60. How RATs infect computers with malicious software
61. This is how government spyware StrongPity uses security researchers' work against them
62. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
63. Inside Safari Extensions | Malicious Plugins Remain on Mojave
64. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
65. H-Worm and jRAT Malware: Two RATs are Better than One
66. How RATs infect computers with malicious software
67. What do you think the combination of the #TrickBot banking Trojan to #IcedID means for the future of banking #Trojans?
68. Updated Azorult malware for sale on the Dark Web
69. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
70. Chinese Cyber Espionage Group using Datper Trojan
71. Burned malware returns, says Cylance report: Is Hacking Team responsible?

EXPLOIT

Nil

VULNERABILITY

72. DHS warns of another dangerous flaw in Advantech WebAccess SCADA software
73. Microsoft Windows zero-day disclosed on Twitter, again
74. AWS FreeRTOS Riddled with Security Vulnerabilities | Avast
75. Critical vulnerabilities in FreeRTOS allowed for IoT device compromise
76. Thousands of applications affected by a zero-day issue injQuery File Upload plugin
77. Grave TCP/IP Flaws In FreeRTOS Leave IoT Gear Open To Mass Hijacking
78. Patch now! Multiple serious flaws found in Drupal
79. Quantifying Vulnerability Risk: How to Quickly Calculate and Prioritize Risk
80. Amazon Patched Multiple IoT Vulnerabilities Affecting Its Smart Devices
81. Amazon patches IoT and critical infrastructure security flaws
82. Patch me, if you can: Grave TCP/IP flaws in FreeRTOS leave IoT gear open to mass hijacking
83. Several vulnerabilities were found in controllers made by @Universal_Robot. Discover what these #robot controllers are used for and how
84. How do newly found flaws affect robot controllers?
85. Firmware zero-day leaves 2m storage devices open to RCE
86. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
87. CyberSecurity Asean security alert on Multiple Vulnerabilities in Cisco WebEx Network Recording Player for Advanced Recording Format Files Could Allow for Arbitrary Code Execution
88. Bug Spells Doom for Nearly-Vacant Google+ Network
89. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw
90. libssh Server-Side Identity Authentication Bypass Vulnerability (CVE-2018-10933)Threat Alert
91. WebLogic Remote Code Execution Vulnerability(CVE-2018-3191)Threat Alert
92. Different Vendors Confirm The Impact Of LibSSH Flaw On Their Products
93. FreeRTOS IoT OS Critical Vulnerabilities Affected Million of Smart Home & Critical Infrastructure Based IoT Devices
94. LIVE555 Streaming library affected by remote code execution vulnerability
95. Windows 10 1809 Zip Extraction Bug Overwrites Files without Confirmation
96. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may

Region brief for 2018-10-23

ASIA

1. FireEye links Russia-owned lab to Trisis developers
2. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
3. Chinese Cyber Espionage Group using Datper Trojan
4. Saudi Investment Site Defaced After Journalist’s Murder
5. NSA Tools Used to Attack Nuclear Energy Firms
6. Burned malware returns, says Cylance report: Is Hacking Team responsible?
7. libssh Server-Side Identity Authentication Bypass Vulnerability (CVE-2018-10933)Threat Alert
8. WebLogic Remote Code Execution Vulnerability(CVE-2018-3191)Threat Alert
9. North Korean Hackers Stole $571 Million Worth of CryptoCoins in Less Than 24 Months
10. Hacking operations with DarkPulsar and other tools developed by the NSA
11. Can Cybercriminals Hack Blockchain?

OCEANIA

Nil

NORTH AMERICA

12. When Ransomware Stopped Working Harder and Started Working Smarter
13. FireEye links Russia-owned lab to Trisis developers
14. An ISP Left Corporate Passwords, Keys, and All its Data Exposed on the Internet
15. Securing Government Operations with Cloud-based Malware Analysis
16. Inside Safari Extensions | Malicious Plugins Remain on Mojave
17. Quantifying Vulnerability Risk: How to Quickly Calculate and Prioritize Risk
18. Phishing attacks becoming more targeted, phishers love Microsoft the most
19. Indiana National Guard hit by ransomware
20. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
21. Saudi Investment Site Defaced After Journalist’s Murder
22. NSA Tools Used to Attack Nuclear Energy Firms
23. Burned malware returns, says Cylance report: Is Hacking Team responsible?
24. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw
25. Can Cybercriminals Hack Blockchain?

SOUTH AMERICA

Nil

EUROPE

26. Experts advocate for 'ATT&CK' as go-to framework to share threat intel
27. FireEye links Russia-owned lab to Trisis developers
28. Triton Malware Linked to Russian Government Research Institute
29. FireEye links Russian research lab to Triton ICS malware attacks
30. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
31. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers
32. #sLoad and #Ramnit pairing in sustained personalized campaigns against UK and Italy
33. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
34. NSA Tools Used to Attack Nuclear Energy Firms
35. “We’re less likely to be caught up in a massive breach of highly available PII or financial data that gets
36. Morrisons loses appeal over data breach
37. Hacking operations with DarkPulsar and other tools developed by the NSA

AFRICA

Nil

Sector brief for 2018-10-23

HEALTHCARE

Nil

TRANSPORT

1. NSA Tools Used to Attack Nuclear Energy Firms
2. Hacking operations with DarkPulsar and other tools developed by the NSA

BANKING & FINANCE

3. Case Study: Ransomware
4. Banking Trojan Infections Persist Throughout the State
5. Inside Safari Extensions | Malicious Plugins Remain on Mojave
6. New Phishing Attack That Uses Multiple Replica Sign-In Pages
7. What do you think the combination of the #TrickBot banking Trojan to #IcedID means for the future of banking #Trojans?
8. Phishing attacks becoming more targeted, phishers love Microsoft the most
9. “We’re less likely to be caught up in a massive breach of highly available PII or financial data that gets
10. Morrisons loses appeal over data breach
11. North Korean Hackers Stole $571 Million Worth of CryptoCoins in Less Than 24 Months
12. Can Cybercriminals Hack Blockchain?

INFORMATION & TELECOMMUNICATION

13. Microsoft Windows zero-day disclosed on Twitter, again
14. When Ransomware Stopped Working Harder and Started Working Smarter
15. Status of Today’s Email as a Malware Vector
16. Banking Trojan Infections Persist Throughout the State
17. An ISP Left Corporate Passwords, Keys, and All its Data Exposed on the Internet
18. Battling Bots: How to Find Fake Twitter Followers
19. Top 10 security steps in Microsoft 365 that political campaigns can take today
20. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
21. Inside Safari Extensions | Malicious Plugins Remain on Mojave
22. Thousands of applications affected by a zero-day issue injQuery File Upload plugin
23. Identify when your data is exposed, your brand is abused, or your company is mentioned on the dark web. Test
24. New Phishing Attack That Uses Multiple Replica Sign-In Pages
25. Facebook has seen several data breaches in the last few months, leading the company to look into acquiring a
26. 5 Ways #Cybercriminals Can Access Your Emails Without Phishing [Infographic]:
27. Police have issued a fresh warning concerning Fortnite and players giving out their personal details online. Cheshire Police posted on Facebook,
28. #sLoad and #Ramnit pairing in sustained personalized campaigns against UK and Italy
29. Why is Elon Musk promoting this Bitcoin scam? (He’s not)
30. "Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
31. Have you ever wondered why #ransomware attacks happen on the Friday before a long weekend? We've teamed up with @SentinelOne
32. Apple has launched its university ID Cards feature in Wallet. Students at three universities can now access their student ID

FOOD

Nil

WATER

Nil

ENERGY

33. FireEye links Russia-owned lab to Trisis developers
34. NSA Tools Used to Attack Nuclear Energy Firms
35. Hacking operations with DarkPulsar and other tools developed by the NSA

GOVERNMENT & PUBLIC SERVICE

36. FireEye links Russia-owned lab to Trisis developers
37. Case Study: Protecting PII
38. Banking Trojan Infections Persist Throughout the State
39. Triton Malware Linked to Russian Government Research Institute
40. Securing Government Operations with Cloud-based Malware Analysis
41. Top 10 security steps in Microsoft 365 that political campaigns can take today
42. This is how government spyware StrongPity uses security researchers' work against them
43. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
44. Indiana National Guard Suffers Ransomware Attack
45. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers
46. Indiana National Guard hit by ransomware
47. Police have issued a fresh warning concerning Fortnite and players giving out their personal details online. Cheshire Police posted on Facebook,
48. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
49. Saudi Investment Site Defaced After Journalist’s Murder
50. CyberSecurity Asean security alert on Multiple Vulnerabilities in Cisco WebEx Network Recording Player for Advanced Recording Format Files Could Allow for Arbitrary Code Execution
51. Morrisons loses appeal over data breach
52. North Korean Hackers Stole $571 Million Worth of CryptoCoins in Less Than 24 Months
53. Can Cybercriminals Hack Blockchain?

Daily brief for 2018-10-23

ASIA

1. FireEye links Russia-owned lab to Trisis developers
2. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
3. Chinese Cyber Espionage Group using Datper Trojan
4. Saudi Investment Site Defaced After Journalist’s Murder
5. NSA Tools Used to Attack Nuclear Energy Firms
6. Burned malware returns, says Cylance report: Is Hacking Team responsible?
7. libssh Server-Side Identity Authentication Bypass Vulnerability (CVE-2018-10933)Threat Alert
8. WebLogic Remote Code Execution Vulnerability(CVE-2018-3191)Threat Alert
9. North Korean Hackers Stole $571 Million Worth of CryptoCoins in Less Than 24 Months
10. Hacking operations with DarkPulsar and other tools developed by the NSA
11. Can Cybercriminals Hack Blockchain?

WORLD

12. When Ransomware Stopped Working Harder and Started Working Smarter
13. Experts advocate for 'ATT&CK' as go-to framework to share threat intel
14. FireEye links Russia-owned lab to Trisis developers
15. Triton Malware Linked to Russian Government Research Institute
16. FireEye links Russian research lab to Triton ICS malware attacks
17. An ISP Left Corporate Passwords, Keys, and All its Data Exposed on the Internet
18. Securing Government Operations with Cloud-based Malware Analysis
19. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
20. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers
21. Inside Safari Extensions | Malicious Plugins Remain on Mojave
22. Quantifying Vulnerability Risk: How to Quickly Calculate and Prioritize Risk
23. Phishing attacks becoming more targeted, phishers love Microsoft the most
24. Indiana National Guard hit by ransomware
25. #sLoad and #Ramnit pairing in sustained personalized campaigns against UK and Italy
26. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
27. Saudi Investment Site Defaced After Journalist’s Murder
28. NSA Tools Used to Attack Nuclear Energy Firms
29. Burned malware returns, says Cylance report: Is Hacking Team responsible?
30. “We’re less likely to be caught up in a massive breach of highly available PII or financial data that gets
31. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw
32. Morrisons loses appeal over data breach
33. Hacking operations with DarkPulsar and other tools developed by the NSA
34. Can Cybercriminals Hack Blockchain?

ATTACKS

35. Case Study: Protecting PII
36. An ISP Left Corporate Passwords, Keys, and All its Data Exposed on the Internet
37. Top 10 security steps in Microsoft 365 that political campaigns can take today
38. Critical vulnerabilities in FreeRTOS allowed for IoT device compromise
39. Thousands of applications affected by a zero-day issue injQuery File Upload plugin
40. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
41. Identify when your data is exposed, your brand is abused, or your company is mentioned on the dark web. Test
42. Phishing is still the most commonly used attack on organizations, survey says
43. New Phishing Attack That Uses Multiple Replica Sign-In Pages
44. How sophisticated phishing grants attackers total control of your computer
45. How sophisticated phishing grants attackers total control of your computer
46. Thousands of Applications Vulnerable to RCE via jQuery File Upload
47. Facebook has seen several data breaches in the last few months, leading the company to look into acquiring a
48. 5 Ways #Cybercriminals Can Access Your Emails Without Phishing [Infographic]:
49. Phishing attacks becoming more targeted, phishers love Microsoft the most
50. Police have issued a fresh warning concerning Fortnite and players giving out their personal details online. Cheshire Police posted on Facebook,
51. Adult websites shuttered after 1.2 million user details exposed
52. #sLoad and #Ramnit pairing in sustained personalized campaigns against UK and Italy
53. Learn how hackers launched #phishing attacks against @netflix users with expert Michael Cobb of @thehairyITdog
54. jQuery? More like preyQuery: File upload tool can be exploited to hijack at-risk websites
55. "Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
56. “We’re less likely to be caught up in a massive breach of highly available PII or financial data that gets
57. Phishing Report Shows Microsoft, Paypal, & Netflix as Top Targets
58. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
59. Morrisons loses appeal over data breach
60. 4 suggerimenti per utilizzare al meglio il vostro #password manager e generare password davvero efficaci. Ebbene sì, repetita juvant :)
61. Morrisons loses appeal against data breach liability ruling
62. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may

THREATS

63. DHS warns of another dangerous flaw in Advantech WebAccess SCADA software
64. Burned malware returns, according to Cylance: is Hacking Team responsible?
65. Microsoft Windows zero-day disclosed on Twitter, again
66. AWS FreeRTOS Riddled with Security Vulnerabilities | Avast
67. When Ransomware Stopped Working Harder and Started Working Smarter
68. City Pays $2K in Ransomware, Stirs ‘Never Pay’ Debate
69. Status of Today’s Email as a Malware Vector
70. Case Study: Destructive Malware
71. Case Study: Ransomware
72. Banking Trojan Infections Persist Throughout the State
73. Triton Malware Linked to Russian Government Research Institute
74. Why the blockchain is not secure
75. FireEye links Russian research lab to Triton ICS malware attacks
76. Securing Government Operations with Cloud-based Malware Analysis
77. How RATs infect computers with malicious software
78. This is how government spyware StrongPity uses security researchers' work against them
79. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
80. Indiana National Guard Suffers Ransomware Attack
81. Inside Safari Extensions | Malicious Plugins Remain on Mojave
82. Critical vulnerabilities in FreeRTOS allowed for IoT device compromise
83. Thousands of applications affected by a zero-day issue injQuery File Upload plugin
84. Grave TCP/IP Flaws In FreeRTOS Leave IoT Gear Open To Mass Hijacking
85. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
86. Trade.io Cold Wallet Hacked Losing 50 Million TIO Tokens – TIO Coin To Be Forked
87. H-Worm and jRAT Malware: Two RATs are Better than One
88. Patch now! Multiple serious flaws found in Drupal
89. How RATs infect computers with malicious software
90. Quantifying Vulnerability Risk: How to Quickly Calculate and Prioritize Risk
91. What do you think the combination of the #TrickBot banking Trojan to #IcedID means for the future of banking #Trojans?
92. Indiana National Guard hit by ransomware
93. Amazon Patched Multiple IoT Vulnerabilities Affecting Its Smart Devices
94. Updated Azorult malware for sale on the Dark Web
95. Amazon patches IoT and critical infrastructure security flaws
96. Why is Elon Musk promoting this Bitcoin scam? (He’s not)
97. UK and US sign military Cyber Accord to dominate cyber domain - with help from business
98. Chinese Cyber Espionage Group using Datper Trojan
99. Patch me, if you can: Grave TCP/IP flaws in FreeRTOS leave IoT gear open to mass hijacking
100. Several vulnerabilities were found in controllers made by @Universal_Robot. Discover what these #robot controllers are used for and how
101. Burned malware returns, says Cylance report: Is Hacking Team responsible?
102. How do newly found flaws affect robot controllers?
103. Firmware zero-day leaves 2m storage devices open to RCE
104. Report: Cryptocurrency hackers earned $20M with 51-percent attacks in 2018
105. A flaw in @Google Firebase #DatabaseSecurity allowed hackers to bypass security and leak data. Learn more about this #SecurityFlaw and
106. CyberSecurity Asean security alert on Multiple Vulnerabilities in Cisco WebEx Network Recording Player for Advanced Recording Format Files Could Allow for Arbitrary Code Execution
107. Bug Spells Doom for Nearly-Vacant Google+ Network
108. The fix for the DOM-based XSS in Branch.io introduced a new XSS flaw
109. libssh Server-Side Identity Authentication Bypass Vulnerability (CVE-2018-10933)Threat Alert
110. Have you ever wondered why #ransomware attacks happen on the Friday before a long weekend? We've teamed up with @SentinelOne
111. WebLogic Remote Code Execution Vulnerability(CVE-2018-3191)Threat Alert
112. Different Vendors Confirm The Impact Of LibSSH Flaw On Their Products
113. Apple has launched its university ID Cards feature in Wallet. Students at three universities can now access their student ID
114. FreeRTOS IoT OS Critical Vulnerabilities Affected Million of Smart Home & Critical Infrastructure Based IoT Devices
115. LIVE555 Streaming library affected by remote code execution vulnerability
116. Can Cybercriminals Hack Blockchain?
117. A Beginner’s Guide to Bitcoin Mining (Bitcoin Mining 101)
118. Windows 10 1809 Zip Extraction Bug Overwrites Files without Confirmation
119. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may

CRIME

120. Inside Safari Extensions | Malicious Plugins Remain on Mojave
121. Thousands of applications affected by a zero-day issue injQuery File Upload plugin
122. H-Worm and jRAT Malware: Two RATs are Better than One
123. New Phishing Attack That Uses Multiple Replica Sign-In Pages
124. Why is Elon Musk promoting this Bitcoin scam? (He’s not)
125. Morrisons loses appeal over data breach
126. North Korean Hackers Stole $571 Million Worth of CryptoCoins in Less Than 24 Months
127. Can Cybercriminals Hack Blockchain?

POLITICS

128. An ISP Left Corporate Passwords, Keys, and All its Data Exposed on the Internet
129. Top 10 security steps in Microsoft 365 that political campaigns can take today
130. Russian Malware Was Apparently Used in an Attempt to Sabotage a Saudi Petrol Plant
131. TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers
132. Chinese Cyber Espionage Group using Datper Trojan
133. Saudi Investment Site Defaced After Journalist’s Murder
134. NSA Tools Used to Attack Nuclear Energy Firms

APT report for 2018-10-22

TRANSNATIONAL / UNKNOWN

Nil

CHINA

1. Oceansalt Attacks Infrastructure, Finance, Universities and Telecommunications
2. Enigmatic cyber espionage campaign revives source code from old foe APT1

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

3. A week in security (October 15 – 21)
4. Safeguarding the Nation’s Critical Infrastructure
5. New APT GreyEnergy Found to Target EU Critical Systems, Linked to BlackEnergy
6. .@ESET researchers claim the #GreyEnergy group has taken up the mantle of ICS-targeting #BlackEnergy, but @MalwareJake said the evidence wasn't

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-10-22

WINDOWS

1. The boom of fileless malware attacks: How can we fight it?
2. The latest variant of Satan ransomware is spreading in the wild
3. Why does Windows 10 have many bugs?

LINUX

Nil

UNIX

Nil

ANDROID

Nil

IOS

4. Apple Voiceover Exploit Allows Attackers Access to Ios Devices

MACOS

5. Apple Voiceover Exploit Allows Attackers Access to Ios Devices

Threat report for 2018-10-22

DATA BREACH & DATA LOSS

1. CMS portal breach exposes 75,000 individuals' records
2. New Ethics Guidance for Lawyers from the American Bar Association (ABA) Regarding Data Breach and Cyber-attack
3. According to the report, researchers detected 33,568 email addresses of finance departments that had been exposed by third parties. Can
4. #NetSpectre leaks data remotely via side-channel attacks. Learn from expert Michael Cobb of @thehairyITdog why data from #microprocessors is not
5. Criminals Hijacked Records of 75 000 Users from
6. A #ZeroDay in #jQuery File Upload could affect thousands of projects because the jQuery #plugin vulnerability has existed for eight
7. Enigmatic cyber espionage campaign revives source code from old foe APT1
8. 75,000 HealthCare.gov Users Exposed, Personal Information Stolen
9. US Indicts Another Russian for Role in Info Warfare Campaign
10. What are DMARC records and can they improve email security?
11. Anthem in Record $16m HIPAA Settlement
12. The Hunt - Our new data breach detection video looks like a Mission Impossible trailer. However, the threats are for
13. #NetSpectre exploits speculative execution to leak data remotely via side-channel attacks. Learn how this #SecurityVulnerability affects the #cloud from expert
14. The most interesting Internet-connected vehicle hacks on record
15. Web Hosting Software VestaCP Server Compromised With DDoS Malware
16. Find out how #TLBleed abuses @Intel's HTT chip feature to leak data via TLB
17. Are you aware of #Canada's data breach regulations? Get up to speed on the #blog:

DENIAL-OF-SERVICE

18. NSA Hacking Tools Used Against Nuke, Aerospace Worlds
19. Web Hosting Software VestaCP Server Compromised With DDoS Malware

MALVERTISING

Nil

PHISHING

20. Phishing Scheme Leverages Azure Blob Storage and Hurricane Michael
21. Strict password policy could prevent credential reuse, paper suggests
22. Natural Disaster Related Phishing Scam Abusing Microsoft Azure to Steal login Credentials & Credit Card Numbers

WEB DEFACEMENT

23. Saudi Future Investment Initiative website defaced by the hackers
24. Hackers Deface Website of Saudi Investment Forum

BOTNET

25. The Russian built #VPNFilter #botnet was taken down by the @FBI after over 500,000 routers were infected. However, VPNFilter is

RANSOMWARE

26. Gamma ransomware compromises data on 16,000 patients at California hernia institute
27. Ransomware: A cheat sheet for professionals
28. The latest variant of Satan ransomware is spreading in the wild

CRYPTOMINING & CRYPTOCURRENCIES

29. Blockchain Security and Privacy
30. Rambus Vaultify Trade: Secure transaction and storage of crypto assets on blockchain
31. .@alienvault researchers recently discovered #MassMiner, a #cryptocurrency mining #malware that has the ability to infect systems across the web. Discover
32. iCloud Hacker Wants $175,000 Ransom to Be Paid In Bitcoin (BTC)
33. Trade.io loses $7.5Mil worth of cryptocurrency in mysterious cold wallet hack
34. Introducing Infura: Connecting DApps With Ethereum Without Setting up Ethereum Nodes
35. Business-minded hackers are testing blockchain technologies to secure their illegal operations. Here's what enterprises can learn from them:
36. India’s First Cryptocurrency ATM To Buy and Sell Cryptocurrencies

MALWARE

37. How a Canadian permanent resident and Saudi Arabian dissident was targeted with powerful spyware on Canadian soil
38. US Tops Global Malware C2 Distribution
39. Signal Upgrade Process Leaves Unencrypted Messages on Disk
40. .@alienvault researchers recently discovered #MassMiner, a #cryptocurrency mining #malware that has the ability to infect systems across the web. Discover
41. The boom of fileless malware attacks: How can we fight it?
42. Octopus Malware
43. Maker of LuminosityLink RAT gets 30 months in the clink
44. Web Hosting Software VestaCP Server Compromised With DDoS Malware
45. Adding the EICAR string to your name as part of the visitor self-registration process is a bit of a faux

EXPLOIT

46. Apple Voiceover Exploit Allows Attackers Access to Ios Devices

VULNERABILITY

47. Cisco, F5 Networks Investigate libssh Vulnerability Impact
48. How to detect hardware-based server bugs
49. Flaw in Media Library Impacts VLC, Other Software
50. Libssh CVE-2018-10933 Scanners & Exploits Released - Apply Updates Now
51. Recent Branch.io Patch Creates New XSS Flaw
52. Critical Bug Impacts Live555 Media Streaming Libraries
53. A newly disclosed #libSSH vulnerability could allow an attacker #AdminAccess to a server with little effort. By @MT_Heller
54. Zero-day jQuery plugin vulnerability exploited for 3 years
55. CVE-2018-4013: LIVE555 streaming media RTSP Server Remote Code Execution Vulnerability
56. Popular website plugin harboured a serious 0-day for years
57. A #ZeroDay in #jQuery File Upload could affect thousands of projects because the jQuery #plugin vulnerability has existed for eight
58. It's OK, I'm verified - Libssh flaw allows attackers to bypass server authentication
59. Repairnator bot finds software bugs, successfully submits patches
60. Drupal Patched Critical RCE Vulnerabilities In Drupal 7 and 8
61. FreeRTOS flaws expose millions of IoT devices to cyber attacks
62. The .@iDefense Vulnerability Contributor Program (VCP) bug-bounty initiative continues to attract top contributors. Join them by submitting your 0-day for
63. Critical vulnerabilities on FreeRTOS expose many systems to attacks
64. WebLogic Remote Code Execution Vulnerability(CVE-2018-3245) Threat Alert
65. MPlayer and VLC media player affected by critical flaw CVE-2018-4013
66. Remote Code Execution Flaws Found in FreeRTOS - Popular OS for Embedded Systems
67. Why does Windows 10 have many bugs?

Region brief for 2018-10-22

ASIA

1. Saudi Future Investment Initiative website defaced by the hackers
2. Hackers Deface Website of Saudi Investment Forum
3. How a Canadian permanent resident and Saudi Arabian dissident was targeted with powerful spyware on Canadian soil
4. Rambus Vaultify Trade: Secure transaction and storage of crypto assets on blockchain
5. A week in security (October 15 – 21)
6. Oceansalt Attacks Infrastructure, Finance, Universities and Telecommunications
7. Enigmatic cyber espionage campaign revives source code from old foe APT1
8. WebLogic Remote Code Execution Vulnerability(CVE-2018-3245) Threat Alert
9. India’s First Cryptocurrency ATM To Buy and Sell Cryptocurrencies

OCEANIA

Nil

NORTH AMERICA

10. How a Canadian permanent resident and Saudi Arabian dissident was targeted with powerful spyware on Canadian soil
11. US Tops Global Malware C2 Distribution
12. A week in security (October 15 – 21)
13. Oceansalt Attacks Infrastructure, Finance, Universities and Telecommunications
14. Safeguarding the Nation’s Critical Infrastructure
15. New Ethics Guidance for Lawyers from the American Bar Association (ABA) Regarding Data Breach and Cyber-attack
16. The boom of fileless malware attacks: How can we fight it?
17. Criminals Hijacked Records of 75 000 Users from
18. Enigmatic cyber espionage campaign revives source code from old foe APT1
19. 75,000 HealthCare.gov Users Exposed, Personal Information Stolen
20. US Indicts Another Russian for Role in Info Warfare Campaign
21. Anthem in Record $16m HIPAA Settlement
22. Are you aware of #Canada's data breach regulations? Get up to speed on the #blog:

SOUTH AMERICA

Nil

EUROPE

23. A week in security (October 15 – 21)
24. The Russian built #VPNFilter #botnet was taken down by the @FBI after over 500,000 routers were infected. However, VPNFilter is
25. iCloud Hacker Wants $175,000 Ransom to Be Paid In Bitcoin (BTC)
26. Repairnator bot finds software bugs, successfully submits patches
27. New APT GreyEnergy Found to Target EU Critical Systems, Linked to BlackEnergy
28. US Indicts Another Russian for Role in Info Warfare Campaign

AFRICA

Nil

Sector brief for 2018-10-22

HEALTHCARE

1. CMS portal breach exposes 75,000 individuals' records
2. Oceansalt Attacks Infrastructure, Finance, Universities and Telecommunications
3. Gamma ransomware compromises data on 16,000 patients at California hernia institute
4. Safeguarding the Nation’s Critical Infrastructure
5. Criminals Hijacked Records of 75 000 Users from
6. 75,000 HealthCare.gov Users Exposed, Personal Information Stolen
7. Critical vulnerabilities on FreeRTOS expose many systems to attacks
8. Anthem in Record $16m HIPAA Settlement

TRANSPORT

9. NSA Hacking Tools Used Against Nuke, Aerospace Worlds
10. Critical vulnerabilities on FreeRTOS expose many systems to attacks

BANKING & FINANCE

11. Rambus Vaultify Trade: Secure transaction and storage of crypto assets on blockchain
12. Oceansalt Attacks Infrastructure, Finance, Universities and Telecommunications
13. According to the report, researchers detected 33,568 email addresses of finance departments that had been exposed by third parties. Can
14. Phishing Scheme Leverages Azure Blob Storage and Hurricane Michael
15. FreeRTOS flaws expose millions of IoT devices to cyber attacks
16. Critical vulnerabilities on FreeRTOS expose many systems to attacks
17. Natural Disaster Related Phishing Scam Abusing Microsoft Azure to Steal login Credentials & Credit Card Numbers
18. India’s First Cryptocurrency ATM To Buy and Sell Cryptocurrencies

INFORMATION & TELECOMMUNICATION

19. Saudi Future Investment Initiative website defaced by the hackers
20. Blockchain Security and Privacy
21. A week in security (October 15 – 21)
22. Popular website plugin harboured a serious 0-day for years
23. The latest variant of Satan ransomware is spreading in the wild

FOOD

Nil

WATER

Nil

ENERGY

24. Safeguarding the Nation’s Critical Infrastructure
25. New APT GreyEnergy Found to Target EU Critical Systems, Linked to BlackEnergy

GOVERNMENT & PUBLIC SERVICE

26. Saudi Future Investment Initiative website defaced by the hackers
27. How a Canadian permanent resident and Saudi Arabian dissident was targeted with powerful spyware on Canadian soil
28. CMS portal breach exposes 75,000 individuals' records
29. Safeguarding the Nation’s Critical Infrastructure
30. Criminals Hijacked Records of 75 000 Users from
31. US Indicts Another Russian for Role in Info Warfare Campaign
32. Anthem in Record $16m HIPAA Settlement