APT report for 2018-10-27

TRANSNATIONAL / UNKNOWN

Nil

CHINA

Nil

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

Nil

SERBIA

Nil

UKRAINE

1. News of the Week: October 27, 2018

Platform report for 2018-10-27

WINDOWS

1. Cisco launches patches for vulnerabilities in WEBEX Meetings app

LINUX

2. The LibSSH Security Bug in the Nutshell

UNIX

Nil

ANDROID

3. The LibSSH Security Bug in the Nutshell

IOS

4. The LibSSH Security Bug in the Nutshell

MACOS

5. The LibSSH Security Bug in the Nutshell

Threat report for 2018-10-27

DATA BREACH & DATA LOSS

Nil

DENIAL-OF-SERVICE

1. DDoS and Ransomware Tools Used by Cyber Criminals Discovered
2. A few dollars to bring down sites with new Bushido-based DDoS-for-hire service
3. Hackers Offering DDoS-for-Hire Service Powered by Bushido Botnet in Dark Web Markets

MALVERTISING

Nil

PHISHING

Nil

WEB DEFACEMENT

Nil

BOTNET

4. Hackers Offering DDoS-for-Hire Service Powered by Bushido Botnet in Dark Web Markets

RANSOMWARE

5. DDoS and Ransomware Tools Used by Cyber Criminals Discovered
6. Decrypt files attacked with the latest versions of GandCrab ransomware

CRYPTOMINING & CRYPTOCURRENCIES

7. Sorry friends, I'm afraid I just can't quite afford the Bitcoin to stop that vid from leaking everywhere
8. Australian Cryptocurrency Theft Highlights Security Mistakes

MALWARE

9. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
10. Bankbot/Anubis downloader hits #1 trending at finance @ThreatFabric @
11. Twelve malicious Python libraries found and removed from PyPI
12. The forensics analysts log the adversaries’ actions and every network packet the hackers send. The adversaries use a process running
13. Executable Formats and How To Exploit Them
14. Unpatched Critical Bug in Microsoft Word Online Video Feature Allow Attacker to Deliver Powerful Malware
15. New malware attacks targeting voters in key states in the 2018 US midterm elections
16. Two hours after the deadline, the forensics team notices someone accessing the MES system server using domain administrator credentials through

EXPLOIT

17. Executable Formats and How To Exploit Them

VULNERABILITY

18. Researchers recently found vulnerabilities within the robot controllers from @Universal_Robot. Learn what these #robot controllers are used for and how
19. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
20. The LibSSH Security Bug in the Nutshell
21. The Pentagon expands the scope of its vulnerability bounty program
22. Unpatched Critical Bug in Microsoft Word Online Video Feature Allow Attacker to Deliver Powerful Malware
23. Cisco launches patches for vulnerabilities in WEBEX Meetings app
24. A #RemoteCodeExecution flaw in @Cisco Webex -- called WebExec -- could be an easy vector for insider attacks, and the

Region brief for 2018-10-27

ASIA

1. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia

OCEANIA

2. Australian Cryptocurrency Theft Highlights Security Mistakes

NORTH AMERICA

3. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
4. Australian Cryptocurrency Theft Highlights Security Mistakes
5. The Pentagon expands the scope of its vulnerability bounty program
6. Decrypt files attacked with the latest versions of GandCrab ransomware
7. New malware attacks targeting voters in key states in the 2018 US midterm elections

SOUTH AMERICA

Nil

EUROPE

8. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
9. Decrypt files attacked with the latest versions of GandCrab ransomware
10. New malware attacks targeting voters in key states in the 2018 US midterm elections

AFRICA

Nil

Sector brief for 2018-10-27

HEALTHCARE

Nil

TRANSPORT

1. A few dollars to bring down sites with new Bushido-based DDoS-for-hire service

BANKING & FINANCE

2. News of the Week: October 27, 2018
3. Australian Cryptocurrency Theft Highlights Security Mistakes
4. Bankbot/Anubis downloader hits #1 trending at finance @ThreatFabric @
5. The Pentagon expands the scope of its vulnerability bounty program

INFORMATION & TELECOMMUNICATION

6. A few dollars to bring down sites with new Bushido-based DDoS-for-hire service
7. Bankbot/Anubis downloader hits #1 trending at finance @ThreatFabric @
8. The LibSSH Security Bug in the Nutshell

FOOD

Nil

WATER

Nil

ENERGY

Nil

GOVERNMENT & PUBLIC SERVICE

9. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
10. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
11. Australian Cryptocurrency Theft Highlights Security Mistakes
12. The Pentagon expands the scope of its vulnerability bounty program
13. Decrypt files attacked with the latest versions of GandCrab ransomware
14. New malware attacks targeting voters in key states in the 2018 US midterm elections

Daily brief for 2018-10-27

ASIA

1. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia

WORLD

2. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
3. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
4. Australian Cryptocurrency Theft Highlights Security Mistakes
5. The Pentagon expands the scope of its vulnerability bounty program
6. Decrypt files attacked with the latest versions of GandCrab ransomware
7. New malware attacks targeting voters in key states in the 2018 US midterm elections

ATTACKS

Nil

THREATS

8. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
9. DDoS and Ransomware Tools Used by Cyber Criminals Discovered
10. Researchers recently found vulnerabilities within the robot controllers from @Universal_Robot. Learn what these #robot controllers are used for and how
11. In this week's Risk & Repeat podcast, editors discuss the #GAOreport on vulnerabilities and weaknesses in military weapons systems and
12. Sorry friends, I'm afraid I just can't quite afford the Bitcoin to stop that vid from leaking everywhere
13. Australian Cryptocurrency Theft Highlights Security Mistakes
14. Bankbot/Anubis downloader hits #1 trending at finance @ThreatFabric @
15. Twelve malicious Python libraries found and removed from PyPI
16. The forensics analysts log the adversaries’ actions and every network packet the hackers send. The adversaries use a process running
17. The LibSSH Security Bug in the Nutshell
18. Executable Formats and How To Exploit Them
19. The Pentagon expands the scope of its vulnerability bounty program
20. Decrypt files attacked with the latest versions of GandCrab ransomware
21. Unpatched Critical Bug in Microsoft Word Online Video Feature Allow Attacker to Deliver Powerful Malware
22. Cisco launches patches for vulnerabilities in WEBEX Meetings app
23. New malware attacks targeting voters in key states in the 2018 US midterm elections
24. Two hours after the deadline, the forensics team notices someone accessing the MES system server using domain administrator credentials through
25. A #RemoteCodeExecution flaw in @Cisco Webex -- called WebExec -- could be an easy vector for insider attacks, and the

CRIME

26. DDoS and Ransomware Tools Used by Cyber Criminals Discovered
27. Australian Cryptocurrency Theft Highlights Security Mistakes
28. Hackers Offering DDoS-for-Hire Service Powered by Bushido Botnet in Dark Web Markets

POLITICS

Nil

APT report for 2018-10-26

TRANSNATIONAL / UNKNOWN

1. British Airways: additional 185,000 passengers may have been affected
2. BA Website Hijacked by Magecart. Again. | Avast
3. US Counters Russian Influence & Magecart Hacks Magento | Avast
4. BA website and data breach by Magecart deeper than first thought
5. BA Breach: An Extra 185K Customers Notified
6. Hackers attack Cathay Pacific
7. Second attack against British Airways is disclosed

CHINA

8. Tracking Tick Through Recent Campaigns Targeting East Asia
9. Operation Oceansalt

INDIA

Nil

NORTH KOREA

10. North Korea Backed Two Cryptocurrency Scams This Year, Says Report

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

11. GreyEnergy cyberespionage group targets Poland and Ukraine
12. Russian sabotage in Saudi petrochemicals

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-10-26

WINDOWS

1. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
2. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset
3. ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping
4. Cisco patches command injection bug in Webex Meetings Desktop App for Windows
5. Vulnerability Spotlight: Talos-2018-0694 - MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
6. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data
7. Zero-day vulnerability in Windows allows privileges escalation

LINUX

8. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
9. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset
10. ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping
11. Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems
12. Chalubo Botnet
13. CVE-2018-14665: Xorg X Server privilege escalation vulnerabilities
14. This two-year-old X.org give-me-root hole is so trivial to exploit, you can fit it in a single tweet
15. Vulnerability Spotlight: Talos-2018-0694 - MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
16. New Privilege Escalation Flaw Affects Most Linux Distributions

UNIX

17. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
18. CVE-2018-14665: Xorg X Server privilege escalation vulnerabilities
19. New Privilege Escalation Flaw Affects Most Linux Distributions

ANDROID

Nil

IOS

Nil

MACOS

20. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset

Threat report for 2018-10-26

DATA BREACH & DATA LOSS

1. ThreatList: 1 Out of 5 Would Ditch a Business After a Data Breach
2. Facebook removes Iranian influence campaign as midterms near
3. Bushido-Powered DDoS Service Whipped Up from Leaked Code
4. British Airways: 185K Affected in Second Data Breach
5. British Airways Data Breach Takes Off Again with 185K More Victims
6. Settlement in Yahoo data breach leaves company to pay $50M
7. Pocket iNET ISP Exposed 73GB of Sensitive Data On Misconfigured S3 Bucket
8. Campaign 2018: New malware attacks target voters in key battleground states
9. Cathay Pacific Hacked, Personal Data For 9.4 Million Passengers Compromised
10. Tracking Tick Through Recent Campaigns Targeting East Asia
11. Details of 9mil compromised in Cathay Pacific data leak
12. Cathay Pacific Suffered Data Breach Affecting 9.4 Million Customers
13. BA website and data breach by Magecart deeper than first thought
14. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
15. Cathay Pacific hack: Personal data of up to 9.4 million airline passengers laid bare
16. Cathay Pacific Says 9.4 Million Affected by Data Breach
17. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may
18. Airline Discovers Trove of Frequent Flyer Accounts Compromised and Posted for Sale Online:
19. British Airways data breach worse than thought
20. Spammers Behind Historic Data Breach Affecting Millions of Facebook Users
21. Cathay Pacific Airways Confirm Data Breach of its Customers
22. “Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
23. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data

DENIAL-OF-SERVICE

24. University DDoS attack leads to $8.6 million fine, house arrest for New Jersey man
25. Bushido-Powered DDoS Service Whipped Up from Leaked Code
26. 16K Strong DDoS-for-Hire Botnet Provides 420+ GB/s Club to Knock Out Websites
27. DemonBot Fans DDoS Flames with Hadoop Enslavement
28. New DemonBot Attack Hadoop Clusters to Performing DDoS Attacks using Powerful Cloud infrastructure servers

MALVERTISING

Nil

PHISHING

29. Microsoft bug makes phishing easy, says cybersecurity firm
30. PhishX –Spear Phishing Tool for Capturing Credentials
31. “Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with

WEB DEFACEMENT

Nil

BOTNET

32. Exploits Block List Grows 50% Because of Spambot, Avalanche/Gamarue botnet
33. 16K Strong DDoS-for-Hire Botnet Provides 420+ GB/s Club to Knock Out Websites
34. Chalubo Botnet
35. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
36. New DemonBot Botnet Pulls the YARN in Hadoop Servers

RANSOMWARE

37. The Week in Ransomware - October 26th 2018 - Decryptors, RaaS, and More
38. 3 Keys to Reducing the Threat of Ransomware

CRYPTOMINING & CRYPTOCURRENCIES

39. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
40. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
41. North Korea regime using and exploiting cryptocurrencies
42. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
43. No Place for Security as Cryptocurrency Skills Demand Soars
44. What Is Gridcoin and How Can It Advance Science?
45. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
46. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
47. How to become a Monero million(th)aire in just 20 minutes [PODCAST]

MALWARE

48. Due to Misconfigured Component: DemonBot Malware Infects Multiple Apache Hadoop Servers
49. PoC Attack Leverages Microsoft Office and YouTube to Deliver Malware
50. ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping
51. Scammers use old browser trick to create fake virus download
52. Campaign 2018: New malware attacks target voters in key battleground states
53. DeepPhish: Simulating Malicious AI to Act Like an Adversary
54. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
55. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
56. An innovative partnership could help Cyber Command fight malware
57. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data

EXPLOIT

58. This two-year-old X.org give-me-root hole is so trivial to exploit, you can fit it in a single tweet

VULNERABILITY

59. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
60. Cloudflare WAF Bypass Vulnerability Discovered
61. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset
62. Vulnerability Spotlight: Talos-2018-0694 – MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
63. Microsoft bug makes phishing easy, says cybersecurity firm
64. A flaw in @Cisco Webex -- called WebExec -- can allow #RemoteCodeExecution. And while experts don't agree on how dangerous
65. Pentagon Expands Bug Bounty To Include Physical Systems
66. WebExec vulnerability leaves Webex open to insider attacks
67. Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems
68. Researchers discovered a vulnerability in Cisco #Webex, called #WebExec, which allows local attackers to issue commands as privileged users. @iagox86
69. Cisco patches command injection bug in Webex Meetings Desktop App for Windows
70. CVE-2018-9206 was maliciously exploited that multiple websites were linked to the search page to jump to the betting site
71. CVE-2018-14665: Xorg X Server privilege escalation vulnerabilities
72. What a crane in the ass: Bug leaves construction machinery vulnerable to evil command injection
73. Researchers report vulnerability in Microsoft Word's online video feature
74. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may
75. Vulnerability Spotlight: Talos-2018-0694 - MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
76. LIVE NETWORKS LIVE555 Streaming Media RTSP Server Remote Code Execution Vulnerability(CVE-2018-4013) Threat Alert
77. New Privilege Escalation Flaw Affects Most Linux Distributions
78. Top 5 Application Vulnerabilities: How to Prevent Risks
79. 7 places to find threat intel beyond vulnerability databases
80. Zero-day vulnerability in Windows allows privileges escalation

Region brief for 2018-10-26

ASIA

1. GreyEnergy cyberespionage group targets Poland and Ukraine
2. Facebook removes Iranian influence campaign as midterms near
3. Exploits Block List Grows 50% Because of Spambot, Avalanche/Gamarue botnet
4. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
5. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
6. Tracking Tick Through Recent Campaigns Targeting East Asia
7. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
8. North Korea regime using and exploiting cryptocurrencies
9. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
10. LIVE NETWORKS LIVE555 Streaming Media RTSP Server Remote Code Execution Vulnerability(CVE-2018-4013) Threat Alert
11. New Privilege Escalation Flaw Affects Most Linux Distributions
12. Operation Oceansalt
13. Hackers attack Cathay Pacific
14. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
15. Russian sabotage in Saudi petrochemicals

OCEANIA

16. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
17. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency

NORTH AMERICA

18. University DDoS attack leads to $8.6 million fine, house arrest for New Jersey man
19. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
20. US Counters Russian Influence & Magecart Hacks Magento | Avast
21. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
22. What a crane in the ass: Bug leaves construction machinery vulnerable to evil command injection
23. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets

SOUTH AMERICA

Nil

EUROPE

24. British Airways: additional 185,000 passengers may have been affected
25. GreyEnergy cyberespionage group targets Poland and Ukraine
26. British Airways: 185K Affected in Second Data Breach
27. BA Website Hijacked by Magecart. Again. | Avast
28. British Airways Data Breach Takes Off Again with 185K More Victims
29. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
30. US Counters Russian Influence & Magecart Hacks Magento | Avast
31. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
32. BA website and data breach by Magecart deeper than first thought
33. No Place for Security as Cryptocurrency Skills Demand Soars
34. BA Breach: An Extra 185K Customers Notified
35. British Airways data breach worse than thought
36. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
37. Hackers attack Cathay Pacific
38. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
39. Second attack against British Airways is disclosed
40. Russian sabotage in Saudi petrochemicals

AFRICA

Nil

Sector brief for 2018-10-26

HEALTHCARE

1. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol

TRANSPORT

2. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
3. Hackers attack Cathay Pacific

BANKING & FINANCE

4. British Airways: additional 185,000 passengers may have been affected
5. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
6. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
7. Details of 9mil compromised in Cathay Pacific data leak
8. CVE-2018-9206 was maliciously exploited that multiple websites were linked to the search page to jump to the betting site
9. Cathay Pacific hack: Personal data of up to 9.4 million airline passengers laid bare
10. No Place for Security as Cryptocurrency Skills Demand Soars
11. BA Breach: An Extra 185K Customers Notified
12. Hackers attack Cathay Pacific
13. Second attack against British Airways is disclosed

INFORMATION & TELECOMMUNICATION

14. University DDoS attack leads to $8.6 million fine, house arrest for New Jersey man
15. Facebook removes Iranian influence campaign as midterms near
16. PoC Attack Leverages Microsoft Office and YouTube to Deliver Malware
17. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
18. Pocket iNET ISP Exposed 73GB of Sensitive Data On Misconfigured S3 Bucket
19. CVE-2018-9206 was maliciously exploited that multiple websites were linked to the search page to jump to the betting site
20. Researchers report vulnerability in Microsoft Word's online video feature
21. Airline Discovers Trove of Frequent Flyer Accounts Compromised and Posted for Sale Online:
22. Spammers Behind Historic Data Breach Affecting Millions of Facebook Users
23. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data
24. Zero-day vulnerability in Windows allows privileges escalation

FOOD

Nil

WATER

Nil

ENERGY

25. GreyEnergy cyberespionage group targets Poland and Ukraine
26. Russian sabotage in Saudi petrochemicals

GOVERNMENT & PUBLIC SERVICE

27. Campaign 2018: New malware attacks target voters in key battleground states
28. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
29. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
30. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
31. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
32. Russian sabotage in Saudi petrochemicals

Daily brief for 2018-10-26

ASIA

1. GreyEnergy cyberespionage group targets Poland and Ukraine
2. Facebook removes Iranian influence campaign as midterms near
3. Exploits Block List Grows 50% Because of Spambot, Avalanche/Gamarue botnet
4. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
5. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
6. Tracking Tick Through Recent Campaigns Targeting East Asia
7. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
8. North Korea regime using and exploiting cryptocurrencies
9. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
10. LIVE NETWORKS LIVE555 Streaming Media RTSP Server Remote Code Execution Vulnerability(CVE-2018-4013) Threat Alert
11. New Privilege Escalation Flaw Affects Most Linux Distributions
12. Operation Oceansalt
13. Hackers attack Cathay Pacific
14. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
15. Russian sabotage in Saudi petrochemicals

WORLD

16. British Airways: additional 185,000 passengers may have been affected
17. University DDoS attack leads to $8.6 million fine, house arrest for New Jersey man
18. GreyEnergy cyberespionage group targets Poland and Ukraine
19. British Airways: 185K Affected in Second Data Breach
20. BA Website Hijacked by Magecart. Again. | Avast
21. British Airways Data Breach Takes Off Again with 185K More Victims
22. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
23. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
24. US Counters Russian Influence & Magecart Hacks Magento | Avast
25. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
26. BA website and data breach by Magecart deeper than first thought
27. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
28. What a crane in the ass: Bug leaves construction machinery vulnerable to evil command injection
29. No Place for Security as Cryptocurrency Skills Demand Soars
30. BA Breach: An Extra 185K Customers Notified
31. British Airways data breach worse than thought
32. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
33. Hackers attack Cathay Pacific
34. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
35. Second attack against British Airways is disclosed
36. Russian sabotage in Saudi petrochemicals

ATTACKS

37. ThreatList: 1 Out of 5 Would Ditch a Business After a Data Breach
38. Facebook removes Iranian influence campaign as midterms near
39. Bushido-Powered DDoS Service Whipped Up from Leaked Code
40. British Airways: 185K Affected in Second Data Breach
41. British Airways Data Breach Takes Off Again with 185K More Victims
42. Microsoft bug makes phishing easy, says cybersecurity firm
43. Settlement in Yahoo data breach leaves company to pay $50M
44. Pocket iNET ISP Exposed 73GB of Sensitive Data On Misconfigured S3 Bucket
45. Campaign 2018: New malware attacks target voters in key battleground states
46. Cathay Pacific Hacked, Personal Data For 9.4 Million Passengers Compromised
47. PhishX –Spear Phishing Tool for Capturing Credentials
48. Tracking Tick Through Recent Campaigns Targeting East Asia
49. Details of 9mil compromised in Cathay Pacific data leak
50. Cathay Pacific Suffered Data Breach Affecting 9.4 Million Customers
51. BA website and data breach by Magecart deeper than first thought
52. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
53. Cathay Pacific hack: Personal data of up to 9.4 million airline passengers laid bare
54. Cathay Pacific Says 9.4 Million Affected by Data Breach
55. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may
56. Airline Discovers Trove of Frequent Flyer Accounts Compromised and Posted for Sale Online:
57. British Airways data breach worse than thought
58. Spammers Behind Historic Data Breach Affecting Millions of Facebook Users
59. Cathay Pacific Airways Confirm Data Breach of its Customers
60. “Advanced attacks, spear-phishing and data breaches are the norm, instead of the exception. We need to address these issues with
61. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data

THREATS

62. Due to Misconfigured Component: DemonBot Malware Infects Multiple Apache Hadoop Servers
63. PoC Attack Leverages Microsoft Office and YouTube to Deliver Malware
64. CVE-2018-14665 privilege escalation flaw affects popular Linux distros
65. Cloudflare WAF Bypass Vulnerability Discovered
66. Code Execution Vulnerability Patched in Cross-Platform MKVToolNix Toolset
67. The Week in Ransomware - October 26th 2018 - Decryptors, RaaS, and More
68. Vulnerability Spotlight: Talos-2018-0694 – MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
69. ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping
70. Microsoft bug makes phishing easy, says cybersecurity firm
71. Scammers use old browser trick to create fake virus download
72. A flaw in @Cisco Webex -- called WebExec -- can allow #RemoteCodeExecution. And while experts don't agree on how dangerous
73. Campaign 2018: New malware attacks target voters in key battleground states
74. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
75. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
76. Pentagon Expands Bug Bounty To Include Physical Systems
77. WebExec vulnerability leaves Webex open to insider attacks
78. DeepPhish: Simulating Malicious AI to Act Like an Adversary
79. Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems
80. .@FireEye #security researchers claimed the Russian government was 'most likely' behind the #Triton #malware attack on an industrial control system
81. North Korea regime using and exploiting cryptocurrencies
82. Researchers discovered a vulnerability in Cisco #Webex, called #WebExec, which allows local attackers to issue commands as privileged users. @iagox86
83. Malicious actors attacked a back-end insurance system and the resulting @HealthCareGov #breach exposed an unknown amount of data on 75,000
84. 3 Keys to Reducing the Threat of Ransomware
85. Cisco patches command injection bug in Webex Meetings Desktop App for Windows
86. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
87. CVE-2018-9206 was maliciously exploited that multiple websites were linked to the search page to jump to the betting site
88. CVE-2018-14665: Xorg X Server privilege escalation vulnerabilities
89. What a crane in the ass: Bug leaves construction machinery vulnerable to evil command injection
90. An innovative partnership could help Cyber Command fight malware
91. Researchers report vulnerability in Microsoft Word's online video feature
92. A #ZeroDay in the popular #jQuery File Upload plugin could affect thousands of projects and the jQuery #plugin vulnerability may
93. No Place for Security as Cryptocurrency Skills Demand Soars
94. Vulnerability Spotlight: Talos-2018-0694 - MKVToolNix mkvinfo read_one_element Code Execution Vulnerability
95. What Is Gridcoin and How Can It Advance Science?
96. LIVE NETWORKS LIVE555 Streaming Media RTSP Server Remote Code Execution Vulnerability(CVE-2018-4013) Threat Alert
97. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
98. New Privilege Escalation Flaw Affects Most Linux Distributions
99. Top 5 Application Vulnerabilities: How to Prevent Risks
100. 7 places to find threat intel beyond vulnerability databases
101. New Malware Abusing Two Legitimate Windows Files to Steal Victims Personal Data
102. China’s Alibaba Cloud Expands Enterprise Blockchain Offering to Global Markets
103. Zero-day vulnerability in Windows allows privileges escalation
104. How to become a Monero million(th)aire in just 20 minutes [PODCAST]

CRIME

105. British Airways: additional 185,000 passengers may have been affected
106. University DDoS attack leads to $8.6 million fine, house arrest for New Jersey man
107. GreyEnergy cyberespionage group targets Poland and Ukraine
108. BA Website Hijacked by Magecart. Again. | Avast
109. Scammers use old browser trick to create fake virus download
110. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
111. 23-year-old woman charged with stealing $320,000 worth of cryptocurrency
112. North Korea Backed Two Cryptocurrency Scams This Year, Says Report
113. No Place for Security as Cryptocurrency Skills Demand Soars
114. BA Breach: An Extra 185K Customers Notified
115. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
116. Hackers attack Cathay Pacific
117. Second attack against British Airways is disclosed
118. Russian sabotage in Saudi petrochemicals

POLITICS

119. GreyEnergy cyberespionage group targets Poland and Ukraine
120. ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping
121. Campaign 2018: New malware attacks target voters in key battleground states
122. Tracking Tick Through Recent Campaigns Targeting East Asia
123. US Counters Russian Influence & Magecart Hacks Magento | Avast
124. Experts presented BOTCHAIN, the first fully functional Botnet built upon the Bitcoin Protocol
125. Russian sabotage in Saudi petrochemicals

APT report for 2018-10-25

TRANSNATIONAL / UNKNOWN

1. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
2. British Airways has some good news and bad news about its payment breach
3. 77K Additional Customers Affected by British Airways' MageCart Data Breach
4. 5 Common Visibility Gaps Your Enterprise Security Plan Can’t Afford
5. Cathay Pacific data breach affecting 9.4 million passengers

CHINA

Nil

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

6. ICS and IIoT Increasingly Vulnerable to Hackers
7. CNI Campaign TRITON Linked to Russian Institute

SERBIA

Nil

UKRAINE

8. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
9. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed

Platform report for 2018-10-25

WINDOWS

1. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
2. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
3. WINDOWS ZERO-DAY BY SANDBOXESCAPER
4. ICS and IIoT Increasingly Vulnerable to Hackers
5. New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed
6. Experts discovered a severe command injection flaw in Cisco Webex Meetings Desktop
7. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack
8. Windows 10 Update Fixed File Deletion Flaw But Not ZIP File Overwrite Bug
9. Google Chrome 70.0.3538.77 released: Bugs fix
10. Windows 10 bug overwrites files without confirmation

LINUX

11. New security flaw impacts most Linux and BSD distros
12. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
13. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack

UNIX

Nil

ANDROID

14. Another one bites the dust! In 2018 Android malware can bypass defences of billon dollar AV industry and Google Play
15. 'TimpDoor' Malware Turns Android Devices into Proxies
16. 5 Common Visibility Gaps Your Enterprise Security Plan Can’t Afford
17. New Android Malware Turns Your Mobile Devices into Hidden Proxies

IOS

18. 5 Common Visibility Gaps Your Enterprise Security Plan Can’t Afford
19. iOS 12 has completely blocked password cracking tool, GrayKey

MACOS

20. Mac Malware Injects Ads Into Encrypted Traffic

Threat report for 2018-10-25

DATA BREACH & DATA LOSS

1. Cutwail Spam Campaign Uses Steganography to Distribute URLZone
2. Cathay Pacific hack: Personal data of up to 9.4 million airline passengers laid bare
3. Another 185K Customers Potentially Affected by the British Airways Data Breach
4. British Airways: Cyberattack, data theft bigger than we first thought
5. Cathay Pacific data breach: 9.4 million passenger information at risk
6. Data Breach Announced by CMS – Approximately 75,000 Individuals’ Files Affected
7. Abandoned Web Apps Found as a Core Cause Behind High Profile Data Breaches
8. Aftermath of the Data Breach: Cathay Pacific Customers Losing Confidence
9. Questions Mount Over Delay After Cathay Pacific Admits Huge Data Leak
10. Multiple Phishing Campaigns Target Universities
11. 77K Additional Customers Affected by British Airways' MageCart Data Breach
12. Cathay Pacific data breach exposes PII of 9.4 million customers
13. Cathay Pacific data breach exposed 9.4m customers’ details
14. Hackers steal personal data of up to 9.4 million Cathay Pacific passengers
15. Hackers steal personal data of up to 9.4 million Cathay Pacific passengers
16. CNI Campaign TRITON Linked to Russian Institute
17. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack
18. Cathay Pacific data breach affecting 9.4 million passengers
19. Data leak at consulting firm handling fundraisers for the Democratic party

DENIAL-OF-SERVICE

20. New DDoS botnet goes after Hadoop enterprise servers
21. New Botnet Launches DDoS Attacks on SSH Servers
22. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack
23. NETSCOUT’s Arbor Cloud Expands DDoS Protection Across Asia

MALVERTISING

Nil

PHISHING

24. Multiple Phishing Campaigns Target Universities
25. Cofense Hunts Phishing Threats Round the Clock with Enhanced 24-hour Global Phishing Defense Services
26. Learn how hackers used TLS certificates to launch @netflix #phishing attacks from expert Michael Cobb of @thehairyITdog
27. iOS 12 has completely blocked password cracking tool, GrayKey

WEB DEFACEMENT

Nil

BOTNET

28. New DDoS botnet goes after Hadoop enterprise servers
29. Hacker creates seven new variants of the Mirai botnet | Avast
30. New Botnet Launches DDoS Attacks on SSH Servers
31. Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack

RANSOMWARE

32. Experts released a free Decryption Tool for GandCrab ransomware
33. New FilesLocker Ransomware Offered as a Ransomware as a Service
34. GandCrab ransomware declawed with new decryption tool
35. Files Encrypted by GandCrab Ransomware Can Now Be Decrypted for Free
36. Bitdefender releases GandCrab ransomware decryption tool
37. Free GrandCrab Ransomware Decryption Tool Released by Bitdefender
38. Free Decrypter Available for the Latest GandCrab Ransomware Versions
39. ESET releases new decryptor for Syrian victims of GandCrab ransomware
40. Free decryption tool released for multiple GandCrab ransomware versions
41. West Haven pays $2k USD because of ransomware attack
42. GandCrab Ransomware decryption tool

CRYPTOMINING & CRYPTOCURRENCIES

43. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
44. North Korea blamed for two cryptocurrency scams, five trading platform hacks
45. Building shared digital identity using blockchain technology

MALWARE

46. Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware
47. Malware Distributors Adopt DKIM to Bypass Mail Filters
48. Cobalt Group tries to slip malicious PDFs past bank employees, researchers say
49. Another one bites the dust! In 2018 Android malware can bypass defences of billon dollar AV industry and Google Play
50. 'TimpDoor' Malware Turns Android Devices into Proxies
51. Bypass an Anti Virus Detection with Encrypted Payloads using VENOM Tool
52. #DidYouKnow AVG Free Antivirus received the highest rating of Advanced+ in @AV_Comparatives latest Malware Protection Test? Share AVG Free Antivirus with
53. Malware Distributors Adopt DKIM to Bypass Mail Filters
54. Mac Malware Injects Ads Into Encrypted Traffic
55. .@FireEye researchers have attributed the #Triton #malware -- used in an attack on an industrial control system in Saudi Arabia
56. FireEye ties Russia to Triton malware attack in Saudi Arabia
57. Our threat intelligence lead Chris Dawson (@mrdatahs) discussing new @proofpoint Threat Insight #Malware research with @threatpost.
58. FireEye links Triton Malware to Russian Research Institute
59. .@FireEye security researchers claimed the Russian government was 'most likely' behind the Triton #malware attack on an industrial control system
60. Russian-Made Malware Used to Attack Saudi Petrol Plant, Claims FireEye
61. What is application security? A process and tools for securing software
62. [BLOG] When #malware actor realizes that he can make more money by himself and transform his dropper into banking malware,
63. New Android Malware Turns Your Mobile Devices into Hidden Proxies

EXPLOIT

64. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these

VULNERABILITY

65. New security flaw impacts most Linux and BSD distros
66. Multiple Vulnerabilities Patched in ASRock Drivers
67. Unusual Remote Execution Bug in Cisco WebEx Discovered by Researchers
68. WINDOWS ZERO-DAY BY SANDBOXESCAPER
69. Sophos Patches RCE and Memory Disclosure Vulnerabilities in
70. Vulnerability Spotlight: TALOS-2018-0635/0636 – Sophos HitmanPro.Alert memory disclosure and code execution vulnerabilities
71. Pentagon Expands Bug-Bounty Program to Include Physical Systems
72. Researchers Find Command Injection Flaw in Cisco WebEx
73. Researchers recently found vulnerabilities in #robot controllers from @Universal_Robot. Learn what these robot controllers do and how #ThreatActors exploit these
74. Microsoft Acknowledges Zip File Overwrite Bug - Fix Coming in November
75. Cisco releases fix for privilege escalation bug in Webex Meetings app
76. Amazon IoT operating system FreeRTOS has serious vulnerabilities
77. Experts discovered a severe command injection flaw in Cisco Webex Meetings Desktop
78. You patch my back(up) and I'll patch yours... Arcserve bugs burrow remotely exploited holes in UDP storage systems
79. Signal Desktop App Vulnerability Exposes Message Decryption Key To The Users
80. Vulnerability Spotlight: TALOS-2018-0635/0636 - Sophos HitmanPro.Alert memory disclosure and code execution vulnerabilities
81. Windows 10 Update Fixed File Deletion Flaw But Not ZIP File Overwrite Bug
82. Google Chrome 70.0.3538.77 released: Bugs fix
83. Win10 1803 big bug bash KB 4462933 joins earlier versions, a week late to the party
84. FreeRTOS Multiple Remote Code Execution Vulnerabilities Threat Alert
85. Java Usage Tracker Vulnerability
86. Windows 10 bug overwrites files without confirmation
87. Unusual Remote Execution Bug in Cisco WebEx Discovered by Researchers