APT report for 2018-11-08

TRANSNATIONAL / UNKNOWN

1. DerpTrolling game server DoS attacker pleads guilty

CHINA

Nil

INDIA

Nil

NORTH KOREA

2. Symantec Uncovers North Korean Group's ATM Attack Malware
3. Lazarus Group Targets Bank Networks to Rob ATMs
4. Hackers from North Korea still breaking into PCs for mining crypto-currencies
5. Symantec researchers dissect North Korean malware used in ATM attacks
6. Top 5 Threats Healthcare Organizations Face and How to Combat Them
7. FASTCash: How the Lazarus Group is Emptying Millions from ATMs

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

8. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
9. Top 5 Threats Healthcare Organizations Face and How to Combat Them
10. U.S. Cyber Command CNMF Shares unclassified malware samples via VirusTotal

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-11-08

WINDOWS

1. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
2. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
3. Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain
4. VirtualBox zero-day flaw released on Github; working exploit available but no patch
5. Cryptocurrency Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine
6. Microsoft Bug is Deactivating Windows 10 Pro Licenses and Downgrading to Home
7. Metamorfo Banking Trojan Keeps Its Sights on Brazil
8. XSS flaw in Evernote allows attackers to execute commands and steal files

LINUX

Nil

UNIX

9. Symantec Uncovers North Korean Group's ATM Attack Malware
10. Lazarus Group Targets Bank Networks to Rob ATMs

ANDROID

11. Google: Newer Android versions are less affected by malware
12. Spyware disguised as Spanish banking apps removed from Google Play
13. A year later, @amarekano's Android overlay bug has been included in the AOSP November 2018 patched notes as CVE-2018-9524

IOS

14. iOS 12.1 Vulnerability

MACOS

Nil

Threat report for 2018-11-08

DATA BREACH & DATA LOSS

1. California Girl Scouts branch suffers data breach
2. IT Security Culture Evolution of Businesses Exposed
3. Canada Post Leaked Personal Data of 4,500 Cannabis Customers
4. 689,272 plaintext records of Amex India customers exposed online
5. 3.6 Billion Records Exposed in Data Breaches Until the End September 2018
6. DJI Drone Flight Logs, Photos and Videos Exposed to Unauthorized Access
7. Canada Post Leaked Personal Data On Cannabis Smokers
8. Drone Vulnerability Could Compromise Enterprise Data
9. Oracle's VirtualBox Vulnerability Leaked By Disgruntled Researcher
10. Radisson Loyalty Program Compromised
11. Test Your Employees with Internal Phishing Campaigns
12. DJI Drone Vulnerability Exposed Customer Data, Flight Logs, Photos and Videos
13. Business email compromise attacks cost over $676 million in 2017, according to the @FBI's Internet #CrimeReport. Learn how to recognize
14. According to the 2018 Cost of a Data Breach Study by @PonemonPrivacy & @IBM, the global average cost of a
15. Canada Post leaked personal data, orders of thousands of cannabis smokers
16. HSBC Bank Alerts US Customers to Data Breach
17. StatCounter platform compromised to infect gate.io exchange with bitcoin-stealing code
18. Users Stop Engaging With Brands After Data Breaches, Report Finds
19. Phishing extortion campaign using new, more effective methods
20. Gamasutra user privacy fragged following IP leak discovery
21. HSBC confirms data theft in the United States
22. Increasing value of personal data a 21st century challenge

DENIAL-OF-SERVICE

23. Cambodia's ISPs Hit By Massive DDoS Attacks
24. DerpTroll Admits To DDoS On EA, Steam, Sony Game Servers
25. 4 Cambodia’s ISPs Attacked by DDoS
26. DDoS attack on Cambodia’s top ISPs reached 150Gbps
27. Man Behind DDoS Attacks on Gaming Companies Pleads Guilty
28. To Pay or Not to Pay: A Large Retailer Responds to #DDoS Extortion Find out what happened here:
29. Cambodia's ISPs hit by some of the biggest DDoS attacks in the country's history
30. Hacker Behind Series of DoS Attack Targeting Gaming Companies Pleaded Guilty

MALVERTISING

Nil

PHISHING

31. Test Your Employees with Internal Phishing Campaigns
32. Most IT Security Pros Underestimate Phishing Risks
33. Most Enterprises Fail to Implement Proper Protection Against Phishing Attacks
34. Phishing extortion campaign using new, more effective methods
35. How many of these bad password habits do you have?
36. Good article about the password problem and a statistic that shows just how bad a problem it has now become...

WEB DEFACEMENT

Nil

BOTNET

37. Botnet Infects 100,000 Routers to Send Outlook, Hotmail, and Yahoo Spam
38. New Spam Botnet Likely Infected 400,000 Devices
39. Spam-spewing IoT botnet infects 100,000 routers using five-year-old flaw
40. Spam-spewing IoT botnet infects 100,000 routers using five-year-old flaw
41. Spam Botnet of Over 100K Routers Abuses UPnP

RANSOMWARE

42. Dharma Ransomware Hits Altus Baytown Hospital's Systems

CRYPTOMINING & CRYPTOCURRENCIES

43. Hackers Charged for Creating 6K Strong Cryptojacking Network
44. Can Blockchain Solve The Problem of Blood Diamonds?
45. Hackers Attack Crypto Exchange With Bitcoin-Stealing Malware
46. Managing the Intersection of Cryptocurrency and Compliance
47. Hackers from North Korea still breaking into PCs for mining crypto-currencies
48. SIM Swapping Hacker Group Who Managed to Steal $80,000 Worth of Cryptocurrency Got Arrested
49. Cryptocurrency Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine
50. Beware of scams! Elon Musk is not giving away bitcoin on Twitter
51. StatCounter platform compromised to infect gate.io exchange with bitcoin-stealing code
52. Canadian University Undergoes A Forced Shutdown After Cryptojacking Attack
53. StatCounter Analytics Code Hijacked to Steal Bitcoins from Cryptocurrency Users

MALWARE

54. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
55. Pentagon Draws Back the Veil on APT Malware with Sudden Embrace of VirusTotal
56. Google: Newer Android versions are less affected by malware
57. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
58. Symantec Uncovers North Korean Group's ATM Attack Malware
59. Metamorfo Banking Trojan Keeps Its Sights on Brazil
60. Hackers Attack Crypto Exchange With Bitcoin-Stealing Malware
61. The Pentagon has suddenly started uploading #malware samples from APTs and other nation-state sources to the website VirusTotal.
62. Symantec researchers dissect North Korean malware used in ATM attacks
63. Banking Malware Takes Aim at Brazilians
64. Cryptocurrency Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine
65. The Cyber National Mission Force will share unclassified U.S. Cyber Command #malware samples to #VirusTotal and one expert hopes there
66. U.S. Cyber Command CNMF Shares unclassified malware samples via VirusTotal
67. US Cyber Command starts uploading foreign APT malware to VirusTotal
68. U.S. Cyber Command malware samples to be logged in VirusTotal
69. Metamorfo Banking Trojan Keeps Its Sights on Brazil
70. Spyware disguised as Spanish banking apps removed from Google Play
71. Unclassified #malware samples from U.S. Cyber Command will be shared with @virustotal by the Cyber National Mission Force. @MalwareJake @stephengillett
72. Did you miss yesterday's #blog? Catch up on how fileless #malware is changing the way we as organizations are treating
73. "The presence of the insecure remote access software on systems used for election management raised concerns that malicious #ThreatActors --
74. U.S. Cyber Command Shares Malware via VirusTotal
75. US Cyber Command starts uploading foreign APT malware to VirusTotal

EXPLOIT

76. Cisco hunts for Apache Struts 2 FileUpload bug and finds DIRTY CoW exploit
77. Cisco Accidentally Released Dirty Cow Exploit Code in Software
78. VirtualBox zero-day flaw released on Github; working exploit available but no patch
79. Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online

VULNERABILITY

80. Companies swamped by critical vulnerabilities – Tenable
81. Cisco hunts for Apache Struts 2 FileUpload bug and finds DIRTY CoW exploit
82. Bleedingbit Vulnerabilities Could Affect Enterprises Worldwide
83. Steam bug could have given you access to all the CD keys of any game
84. Drone Vulnerability Could Compromise Enterprise Data
85. Oracle's VirtualBox Vulnerability Leaked By Disgruntled Researcher
86. [SingCERT] Alert on Nginx Vulnerabilities (CVE-2018-16843, CVE-2018-16844, and CVE-2018-16845)
87. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
88. Several Vulnerabilities Patched in nginx
89. Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain
90. WooCommerce Plugin file deletion vulnerability exposes WordPress 'failing open' design flaw
91. VirtualBox zero-day flaw released on Github; working exploit available but no patch
92. DJI Drone Vulnerability Exposed Customer Data, Flight Logs, Photos and Videos
93. DJI Patches Forum Bug That Allowed Drone Account Takeovers
94. Spam-spewing IoT botnet infects 100,000 routers using five-year-old flaw
95. Ranting researcher publishes VM-busting zero-day without warning
96. Spam-spewing IoT botnet infects 100,000 routers using five-year-old flaw
97. DJI Drone Vulnerability
98. iOS 12.1 Vulnerability
99. Encryption flaws in solid state drives enable unauthorised data access
100. Microsoft Bug is Deactivating Windows 10 Pro Licenses and Downgrading to Home
101. Ranting researcher publishes #VM-busting zero-day without warning
102. We don' need no stinkin' bounties: VirtualBox guest-to-host escape zero-day lands at GitHub
103. Vulnerabilities In Major Self-Encrypting SSDs Allow Encryption Bypass and Affect Bitlocker
104. [SingCERT] Alert on Critical Apache Struts 2 Remote Code Execution Vulnerability (CVE-2016-1000031)
105. XSS flaw in Evernote allows attackers to execute commands and steal files
106. Critical authentication flaw in DJI drone web app fixed
107. Commoditization of Computing Hardware and the Bugs It Contains
108. 4 Million Shops Installed WooCommerce Plugin RCE Flaw Allows Attacker to Gain WordPress Sites Admin Access
109. A year later, @amarekano's Android overlay bug has been included in the AOSP November 2018 patched notes as CVE-2018-9524
110. Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online

Region brief for 2018-11-08

ASIA

1. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
2. 689,272 plaintext records of Amex India customers exposed online
3. Cambodia's ISPs Hit By Massive DDoS Attacks
4. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
5. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
6. Symantec Uncovers North Korean Group's ATM Attack Malware
7. Lazarus Group Targets Bank Networks to Rob ATMs
8. 4 Cambodia’s ISPs Attacked by DDoS
9. Hackers from North Korea still breaking into PCs for mining crypto-currencies
10. DDoS attack on Cambodia’s top ISPs reached 150Gbps
11. Symantec researchers dissect North Korean malware used in ATM attacks
12. SIM Swapping Hacker Group Who Managed to Steal $80,000 Worth of Cryptocurrency Got Arrested
13. Spam Botnet of Over 100K Routers Abuses UPnP
14. Cambodia's ISPs hit by some of the biggest DDoS attacks in the country's history
15. HSBC confirms data theft in the United States
16. Commoditization of Computing Hardware and the Bugs It Contains

OCEANIA

Nil

NORTH AMERICA

17. Bleedingbit Vulnerabilities Could Affect Enterprises Worldwide
18. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
19. Canada Post Leaked Personal Data of 4,500 Cannabis Customers
20. 689,272 plaintext records of Amex India customers exposed online
21. Canada Post Leaked Personal Data On Cannabis Smokers
22. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
23. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
24. Lazarus Group Targets Bank Networks to Rob ATMs
25. Most IT Security Pros Underestimate Phishing Risks
26. Hackers from North Korea still breaking into PCs for mining crypto-currencies
27. Symantec researchers dissect North Korean malware used in ATM attacks
28. Beware of scams! Elon Musk is not giving away bitcoin on Twitter
29. Spam Botnet of Over 100K Routers Abuses UPnP
30. The Cyber National Mission Force will share unclassified U.S. Cyber Command #malware samples to #VirusTotal and one expert hopes there
31. U.S. Cyber Command CNMF Shares unclassified malware samples via VirusTotal
32. Canada Post leaked personal data, orders of thousands of cannabis smokers
33. HSBC Bank Alerts US Customers to Data Breach
34. US Cyber Command starts uploading foreign APT malware to VirusTotal
35. U.S. Cyber Command malware samples to be logged in VirusTotal
36. Metamorfo Banking Trojan Keeps Its Sights on Brazil
37. Unclassified #malware samples from U.S. Cyber Command will be shared with @virustotal by the Cyber National Mission Force. @MalwareJake @stephengillett
38. Canadian University Undergoes A Forced Shutdown After Cryptojacking Attack
39. U.S. Cyber Command Shares Malware via VirusTotal
40. HSBC confirms data theft in the United States
41. US Cyber Command starts uploading foreign APT malware to VirusTotal

SOUTH AMERICA

42. Metamorfo Banking Trojan Keeps Its Sights on Brazil
43. Banking Malware Takes Aim at Brazilians
44. Metamorfo Banking Trojan Keeps Its Sights on Brazil
45. HSBC confirms data theft in the United States

EUROPE

46. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
47. Hackers Attack Crypto Exchange With Bitcoin-Stealing Malware
48. Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain
49. Cryptocurrency Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine
50. iOS 12.1 Vulnerability
51. Beware of scams! Elon Musk is not giving away bitcoin on Twitter
52. U.S. Cyber Command CNMF Shares unclassified malware samples via VirusTotal
53. Encryption flaws in solid state drives enable unauthorised data access
54. Spyware disguised as Spanish banking apps removed from Google Play
55. HSBC confirms data theft in the United States

AFRICA

Nil

Sector brief for 2018-11-08

HEALTHCARE

1. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
2. Dharma Ransomware Hits Altus Baytown Hospital's Systems
3. Top 5 Threats Healthcare Organizations Face and How to Combat Them

TRANSPORT

4. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems

BANKING & FINANCE

5. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
6. California Girl Scouts branch suffers data breach
7. Dharma Ransomware Hits Altus Baytown Hospital's Systems
8. Can Blockchain Solve The Problem of Blood Diamonds?
9. Symantec Uncovers North Korean Group's ATM Attack Malware
10. Metamorfo Banking Trojan Keeps Its Sights on Brazil
11. Test Your Employees with Internal Phishing Campaigns
12. Lazarus Group Targets Bank Networks to Rob ATMs
13. Hackers from North Korea still breaking into PCs for mining crypto-currencies
14. Symantec researchers dissect North Korean malware used in ATM attacks
15. Top 5 Threats Healthcare Organizations Face and How to Combat Them
16. Banking Malware Takes Aim at Brazilians
17. Beware of scams! Elon Musk is not giving away bitcoin on Twitter
18. FASTCash: How the Lazarus Group is Emptying Millions from ATMs
19. HSBC Bank Alerts US Customers to Data Breach
20. Metamorfo Banking Trojan Keeps Its Sights on Brazil
21. Spyware disguised as Spanish banking apps removed from Google Play
22. HSBC confirms data theft in the United States

INFORMATION & TELECOMMUNICATION

23. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
24. Botnet Infects 100,000 Routers to Send Outlook, Hotmail, and Yahoo Spam
25. Canada Post Leaked Personal Data of 4,500 Cannabis Customers
26. 689,272 plaintext records of Amex India customers exposed online
27. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
28. 4 Cambodia’s ISPs Attacked by DDoS
29. DDoS attack on Cambodia’s top ISPs reached 150Gbps
30. Cryptocurrency Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine
31. Beware of scams! Elon Musk is not giving away bitcoin on Twitter
32. Spam Botnet of Over 100K Routers Abuses UPnP
33. U.S. Cyber Command CNMF Shares unclassified malware samples via VirusTotal
34. US Cyber Command starts uploading foreign APT malware to VirusTotal
35. To Pay or Not to Pay: A Large Retailer Responds to #DDoS Extortion Find out what happened here:
36. How many of these bad password habits do you have?
37. Did you miss yesterday's #blog? Catch up on how fileless #malware is changing the way we as organizations are treating
38. Commoditization of Computing Hardware and the Bugs It Contains
39. Good article about the password problem and a statistic that shows just how bad a problem it has now become...

FOOD

Nil

WATER

Nil

ENERGY

40. Bleedingbit Vulnerabilities Could Affect Enterprises Worldwide
41. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems

GOVERNMENT & PUBLIC SERVICE

42. Pentagon Draws Back the Veil on APT Malware with Sudden Embrace of VirusTotal
43. Hackers Charged for Creating 6K Strong Cryptojacking Network
44. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
45. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
46. Lazarus Group Targets Bank Networks to Rob ATMs
47. Hackers from North Korea still breaking into PCs for mining crypto-currencies
48. Symantec researchers dissect North Korean malware used in ATM attacks
49. SIM Swapping Hacker Group Who Managed to Steal $80,000 Worth of Cryptocurrency Got Arrested
50. "The presence of the insecure remote access software on systems used for election management raised concerns that malicious #ThreatActors --

Daily brief for 2018-11-08

ASIA

1. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
2. 689,272 plaintext records of Amex India customers exposed online
3. Cambodia's ISPs Hit By Massive DDoS Attacks
4. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
5. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
6. Symantec Uncovers North Korean Group's ATM Attack Malware
7. Lazarus Group Targets Bank Networks to Rob ATMs
8. 4 Cambodia’s ISPs Attacked by DDoS
9. Hackers from North Korea still breaking into PCs for mining crypto-currencies
10. DDoS attack on Cambodia’s top ISPs reached 150Gbps
11. Symantec researchers dissect North Korean malware used in ATM attacks
12. SIM Swapping Hacker Group Who Managed to Steal $80,000 Worth of Cryptocurrency Got Arrested
13. Spam Botnet of Over 100K Routers Abuses UPnP
14. Cambodia's ISPs hit by some of the biggest DDoS attacks in the country's history
15. HSBC confirms data theft in the United States
16. Commoditization of Computing Hardware and the Bugs It Contains

WORLD

17. Bleedingbit Vulnerabilities Could Affect Enterprises Worldwide
18. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
19. Canada Post Leaked Personal Data of 4,500 Cannabis Customers
20. 689,272 plaintext records of Amex India customers exposed online
21. Canada Post Leaked Personal Data On Cannabis Smokers
22. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
23. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
24. Metamorfo Banking Trojan Keeps Its Sights on Brazil
25. Lazarus Group Targets Bank Networks to Rob ATMs
26. Hackers Attack Crypto Exchange With Bitcoin-Stealing Malware
27. Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain
28. Most IT Security Pros Underestimate Phishing Risks
29. Hackers from North Korea still breaking into PCs for mining crypto-currencies
30. Symantec researchers dissect North Korean malware used in ATM attacks
31. Banking Malware Takes Aim at Brazilians
32. Cryptocurrency Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine
33. iOS 12.1 Vulnerability
34. Beware of scams! Elon Musk is not giving away bitcoin on Twitter
35. Spam Botnet of Over 100K Routers Abuses UPnP
36. The Cyber National Mission Force will share unclassified U.S. Cyber Command #malware samples to #VirusTotal and one expert hopes there
37. U.S. Cyber Command CNMF Shares unclassified malware samples via VirusTotal
38. Encryption flaws in solid state drives enable unauthorised data access
39. Canada Post leaked personal data, orders of thousands of cannabis smokers
40. HSBC Bank Alerts US Customers to Data Breach
41. US Cyber Command starts uploading foreign APT malware to VirusTotal
42. U.S. Cyber Command malware samples to be logged in VirusTotal
43. Metamorfo Banking Trojan Keeps Its Sights on Brazil
44. Spyware disguised as Spanish banking apps removed from Google Play
45. Unclassified #malware samples from U.S. Cyber Command will be shared with @virustotal by the Cyber National Mission Force. @MalwareJake @stephengillett
46. Canadian University Undergoes A Forced Shutdown After Cryptojacking Attack
47. U.S. Cyber Command Shares Malware via VirusTotal
48. HSBC confirms data theft in the United States
49. US Cyber Command starts uploading foreign APT malware to VirusTotal

ATTACKS

50. California Girl Scouts branch suffers data breach
51. IT Security Culture Evolution of Businesses Exposed
52. Canada Post Leaked Personal Data of 4,500 Cannabis Customers
53. 689,272 plaintext records of Amex India customers exposed online
54. 3.6 Billion Records Exposed in Data Breaches Until the End September 2018
55. DJI Drone Flight Logs, Photos and Videos Exposed to Unauthorized Access
56. Canada Post Leaked Personal Data On Cannabis Smokers
57. Drone Vulnerability Could Compromise Enterprise Data
58. Oracle's VirtualBox Vulnerability Leaked By Disgruntled Researcher
59. Radisson Loyalty Program Compromised
60. Test Your Employees with Internal Phishing Campaigns
61. Most IT Security Pros Underestimate Phishing Risks
62. DJI Drone Vulnerability Exposed Customer Data, Flight Logs, Photos and Videos
63. Business email compromise attacks cost over $676 million in 2017, according to the @FBI's Internet #CrimeReport. Learn how to recognize
64. Most Enterprises Fail to Implement Proper Protection Against Phishing Attacks
65. According to the 2018 Cost of a Data Breach Study by @PonemonPrivacy & @IBM, the global average cost of a
66. Canada Post leaked personal data, orders of thousands of cannabis smokers
67. HSBC Bank Alerts US Customers to Data Breach
68. StatCounter platform compromised to infect gate.io exchange with bitcoin-stealing code
69. Users Stop Engaging With Brands After Data Breaches, Report Finds
70. Phishing extortion campaign using new, more effective methods
71. Gamasutra user privacy fragged following IP leak discovery
72. How many of these bad password habits do you have?
73. HSBC confirms data theft in the United States
74. Increasing value of personal data a 21st century challenge
75. Good article about the password problem and a statistic that shows just how bad a problem it has now become...

THREATS

76. Companies swamped by critical vulnerabilities – Tenable
77. Cisco hunts for Apache Struts 2 FileUpload bug and finds DIRTY CoW exploit
78. Bleedingbit Vulnerabilities Could Affect Enterprises Worldwide
79. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
80. Pentagon Draws Back the Veil on APT Malware with Sudden Embrace of VirusTotal
81. Google: Newer Android versions are less affected by malware
82. Hackers Charged for Creating 6K Strong Cryptojacking Network
83. Dharma Ransomware Hits Altus Baytown Hospital's Systems
84. Steam bug could have given you access to all the CD keys of any game
85. Drone Vulnerability Could Compromise Enterprise Data
86. Oracle's VirtualBox Vulnerability Leaked By Disgruntled Researcher
87. [SingCERT] Alert on Nginx Vulnerabilities (CVE-2018-16843, CVE-2018-16844, and CVE-2018-16845)
88. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
89. Can Blockchain Solve The Problem of Blood Diamonds?
90. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
91. Symantec Uncovers North Korean Group's ATM Attack Malware
92. Several Vulnerabilities Patched in nginx
93. Metamorfo Banking Trojan Keeps Its Sights on Brazil
94. Hackers Attack Crypto Exchange With Bitcoin-Stealing Malware
95. The Pentagon has suddenly started uploading #malware samples from APTs and other nation-state sources to the website VirusTotal.
96. Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain
97. WooCommerce Plugin file deletion vulnerability exposes WordPress 'failing open' design flaw
98. Managing the Intersection of Cryptocurrency and Compliance
99. VirtualBox zero-day flaw released on Github; working exploit available but no patch
100. Hackers from North Korea still breaking into PCs for mining crypto-currencies
101. DJI Drone Vulnerability Exposed Customer Data, Flight Logs, Photos and Videos
102. DJI Patches Forum Bug That Allowed Drone Account Takeovers
103. Spam-spewing IoT botnet infects 100,000 routers using five-year-old flaw
104. Symantec researchers dissect North Korean malware used in ATM attacks
105. SIM Swapping Hacker Group Who Managed to Steal $80,000 Worth of Cryptocurrency Got Arrested
106. Ranting researcher publishes VM-busting zero-day without warning
107. Spam-spewing IoT botnet infects 100,000 routers using five-year-old flaw
108. Banking Malware Takes Aim at Brazilians
109. DJI Drone Vulnerability
110. Cryptocurrency Mining Malware uses Various Evasion Techniques, Including Windows Installer, as Part of its Routine
111. iOS 12.1 Vulnerability
112. Beware of scams! Elon Musk is not giving away bitcoin on Twitter
113. The Cyber National Mission Force will share unclassified U.S. Cyber Command #malware samples to #VirusTotal and one expert hopes there
114. U.S. Cyber Command CNMF Shares unclassified malware samples via VirusTotal
115. Encryption flaws in solid state drives enable unauthorised data access
116. Microsoft Bug is Deactivating Windows 10 Pro Licenses and Downgrading to Home
117. Ranting researcher publishes #VM-busting zero-day without warning
118. We don' need no stinkin' bounties: VirtualBox guest-to-host escape zero-day lands at GitHub
119. StatCounter platform compromised to infect gate.io exchange with bitcoin-stealing code
120. Vulnerabilities In Major Self-Encrypting SSDs Allow Encryption Bypass and Affect Bitlocker
121. [SingCERT] Alert on Critical Apache Struts 2 Remote Code Execution Vulnerability (CVE-2016-1000031)
122. US Cyber Command starts uploading foreign APT malware to VirusTotal
123. U.S. Cyber Command malware samples to be logged in VirusTotal
124. Metamorfo Banking Trojan Keeps Its Sights on Brazil
125. Spyware disguised as Spanish banking apps removed from Google Play
126. XSS flaw in Evernote allows attackers to execute commands and steal files
127. Unclassified #malware samples from U.S. Cyber Command will be shared with @virustotal by the Cyber National Mission Force. @MalwareJake @stephengillett
128. Canadian University Undergoes A Forced Shutdown After Cryptojacking Attack
129. Did you miss yesterday's #blog? Catch up on how fileless #malware is changing the way we as organizations are treating
130. "The presence of the insecure remote access software on systems used for election management raised concerns that malicious #ThreatActors --
131. U.S. Cyber Command Shares Malware via VirusTotal
132. Critical authentication flaw in DJI drone web app fixed
133. Commoditization of Computing Hardware and the Bugs It Contains
134. 4 Million Shops Installed WooCommerce Plugin RCE Flaw Allows Attacker to Gain WordPress Sites Admin Access
135. A year later, @amarekano's Android overlay bug has been included in the AOSP November 2018 patched notes as CVE-2018-9524
136. StatCounter Analytics Code Hijacked to Steal Bitcoins from Cryptocurrency Users
137. Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online
138. US Cyber Command starts uploading foreign APT malware to VirusTotal

CRIME

139. California Girl Scouts branch suffers data breach
140. 3.6 Billion Records Exposed in Data Breaches Until the End September 2018
141. Can Blockchain Solve The Problem of Blood Diamonds?
142. Radisson Loyalty Program Compromised
143. Test Your Employees with Internal Phishing Campaigns
144. Lazarus Group Targets Bank Networks to Rob ATMs
145. Hackers Attack Crypto Exchange With Bitcoin-Stealing Malware
146. Hackers from North Korea still breaking into PCs for mining crypto-currencies
147. Business email compromise attacks cost over $676 million in 2017, according to the @FBI's Internet #CrimeReport. Learn how to recognize
148. Symantec researchers dissect North Korean malware used in ATM attacks
149. Top 5 Threats Healthcare Organizations Face and How to Combat Them
150. Man Behind DDoS Attacks on Gaming Companies Pleads Guilty
151. DerpTrolling game server DoS attacker pleads guilty
152. HSBC Bank Alerts US Customers to Data Breach
153. Phishing extortion campaign using new, more effective methods
154. To Pay or Not to Pay: A Large Retailer Responds to #DDoS Extortion Find out what happened here:
155. Spyware disguised as Spanish banking apps removed from Google Play
156. Hacker Behind Series of DoS Attack Targeting Gaming Companies Pleaded Guilty
157. HSBC confirms data theft in the United States

POLITICS

158. Triton Malware Spearheads Latest Generation of Attacks on Industrial Systems
159. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
160. Lazarus Group Targets Bank Networks to Rob ATMs
161. 4 Cambodia’s ISPs Attacked by DDoS
162. Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain
163. Hackers from North Korea still breaking into PCs for mining crypto-currencies
164. "The presence of the insecure remote access software on systems used for election management raised concerns that malicious #ThreatActors --

APT report for 2018-11-07

TRANSNATIONAL / UNKNOWN

1. Feds get guilty plea in 'DerpTrolling' attacks on video game sites
2. Goblin Panda
3. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts

CHINA

Nil

INDIA

Nil

NORTH KOREA

Nil

PAKISTAN

Nil

VIETNAM

Nil

IRAN

Nil

IRAQ

Nil

LEBANON

Nil

PALESTINE

Nil

SAUDI ARABIA

Nil

SYRIA

Nil

TURKEY

Nil

UNITED ARAB EMIRATES

Nil

YEMEN

Nil

RUSSIA

Nil

SERBIA

Nil

UKRAINE

Nil

Platform report for 2018-11-07

WINDOWS

1. Evernote Flaw Allows Hackers to Steal Files, Execute Commands
2. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
3. Erratic Windows 10 Bug Breaks Changing of Default File Associations
4. Researcher discloses VirtualBox Zero-Day without reporting it to Oracle
5. Serious XSS flaw discovered in Evernote for Windows, update now!
6. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
7. Linux servers and IoT devices, main targets of Shellbot botnet
8. Vulnerabilities in self encrypted SSD allow attackers to bypass disk encryption

LINUX

9. Researcher discloses VirtualBox Zero-Day without reporting it to Oracle
10. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
11. Linux servers and IoT devices, main targets of Shellbot botnet

UNIX

Nil

ANDROID

12. 3,2 Million New Android Malicious Apps Detected Until the End of Q3 2018
13. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
14. Not sure how to tell if your Android phone has a virus? Android malware comes in many forms, ranging from spyware
15. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
16. November Android Security Update Fixes Critical Bugs, Drops Media Library
17. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
18. Linux servers and IoT devices, main targets of Shellbot botnet

IOS

19. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts

MACOS

20. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts

Threat report for 2018-11-07

DATA BREACH & DATA LOSS

1. New Jersey AG Announces $200,000 Settlement with Business Associate and Permanent Ban for BA’s Owner due to 2016 Data Breach Affecting Over 1,650 Patients
2. Half a Million People Potentially Affected by Data Breach at Bankers Life
3. Data Of Nearly 700,000 Amex India Customers Exposed Via Unsecured MongoDB Server
4. HSBC Bank Suffers Data Breach
5. Amex India accounts exposed by misconfigured MongoDB installation
6. Data of nearly 700,000 Amex India customers exposed via unsecured MongoDB server
7. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
8. HSBC Bank Data Breach Exposed Customer’s Account Details and More
9. HSBC US Customers Hit by Data Breach
10. What do you think is the average cost of a data breach?
11. HSBC now stands for Hapless Security, Became Compromised: Thousands of customer files snatched by crims
12. ICO poised to fine Leave campaign and Arron Banks’ insurance biz £135,000
13. HSBC suffers data breach, customer banking info exposed
14. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
15. New dropper campaign with at least 8 droppers in #GooglePlay (30k+ installs total), found with the help of @avast_antivirus @apklabio.
16. How voting history data benefits political campaigns
17. HSBC Bank Data Breach Exposed Account Numbers, Balances, Transaction History and Other Details
18. Personal data of police and ministries employees leaked by Anonymous Italy
19. Five Guys suffers employees’ data theft
20. Rushed My Health Record changes still missing the point
21. What businesses can learn from political campaigns about using big data

DENIAL-OF-SERVICE

Nil

MALVERTISING

Nil

PHISHING

22. A Phishing Incident is Being Investigated by the Carthage Police
23. Why you should use a password manager
24. They stopped a phishing attack in 10 minutes. It used to take days.
25. Password Grabber Module Added to Trickbot
26. Why Password Management and Security Strategies Fall Short
27. Learn About Phishing Incident Response on Nov 15
28. Learn why @Google chose U2F authentication over OTP to eliminate #PhishingEmails from expert Michael Cobb of @thehairyITdog.
29. A poor password is a key for the wrong person to get in.

WEB DEFACEMENT

Nil

BOTNET

30. IoT Botnet Infects 100,000 Routers To Send Spam
31. Rapidly Growing Router Botnet Takes Advantage of 5-Year-Old Flaw
32. IoT botnet infects 100,000 routers to send Hotmail, Outlook, and Yahoo spam
33. A fresh #botnet is rapidly growing by targeting a five-year-old #vulnerability. So far, @360Netlab said hundreds of thousands of bot
34. Linux servers and IoT devices, main targets of Shellbot botnet

RANSOMWARE

35. Healthcare Targeted by 37 Percent of All Ransomware Attacks in Q3 2018
36. Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines
37. #SamSam #ransomware targeted 67 organizations in 2018, according to @symantec research. By @MaddieBacon11
38. How to Remove NOBAD Ransomware
39. #Kraken #ransomware as a service is getting more popular after being bundled into the Fallout #ExploitKit and getting more update
40. Managing Third-Party Risk in the Age of Ransomware

CRYPTOMINING & CRYPTOCURRENCIES

41. Uni cans crypto-mining CPU raid by switching off whole IT network
42. Salesforce Aims to Curb Spam With Blockchain
43. Using Blockchain Technology to Solve Global Problems
44. JavaScript attack aimed to reroute bitcoin transactions
45. University shuts down network to thwart Bitcoin cryptojacking scheme
46. Attackers breached Statcounter to steal cryptocurrency from gate.io users
47. Elon Musk Bitcoin Scammers Hijack Verified Status Accounts
48. #Kraken #ransomware as a service is getting more popular after being bundled into the Fallout #ExploitKit and getting more update
49. Hackers seed StatCounter with nasty JavaScript in elaborate Bitcoin theft scheme
50. Blockchain: The Good, the Bad and the Legal
51. New cryptocurrencies offer better anonymity, new security challenges, from @CSOonline http://0fox.co/sSmx30i8vm4 ZeroFOX CTO weighs in on the #infosec challenges
52. Bitcoin Cryptojacking Attack Forces University to Disable Entire Network
53. Researchers rank cryptocurrency exchanges by how secure they are

MALWARE

54. Cisco removed its seventh backdoor account this year, and that's a good thing
55. 3,2 Million New Android Malicious Apps Detected Until the End of Q3 2018
56. Not sure how to tell if your Android phone has a virus? Android malware comes in many forms, ranging from spyware
57. Weekly Threat Briefing: Scammers Ride on Popular Vote411 Voter Info Site to Push Scareware Alerts
58. On the #blog today, we talk about how fileless malware is changing the way we as organizations treats #cyberthreats.
59. We recently detected an Android banking malware campaign (Anubis) actively targeting the Dutch market by #abusing the @PostNL brand. After
60. New dropper campaign with at least 8 droppers in #GooglePlay (30k+ installs total), found with the help of @avast_antivirus @apklabio.
61. Coupa Simplifies Fragmented B2B Payments Process
62. Turning Malware Trends into Proactive Behaviors
63. DHS on Election Day: No malicious cyber-activity observed
64. AMD and TSMC outline 7nm process products to be listed next year

EXPLOIT

65. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
66. VirtualBox Guest-to-Host escape 0day and exploit released online
67. According to @digitalshadows, attackers used a browser exploit to steal the private #Facebook messages of at least 81,000 people. Read
68. #Virtualbox hat eine #Zeroday Sicherheitslücke. Tipp: Ändern Sie Ihren virtuellen Netzwerkadapter auf etwas anderes als Intel PRO/1000.
69. VirtualBox Zero-Day Vulnerability Details and Exploit Are Publicly Available

VULNERABILITY

70. U.S. Air Force announced Hack the Air Force 3.0, the third Bug Bounty Program
71. Security Flaws Found in Widely Used Data Storage Devices | Avast
72. A flaw in WooCommerce WordPress Plugin could be exploited to take over e-stores
73. Flaw in Icecast streaming media server allows to take off online Radio Stations
74. VirtualBox zero-day dumped on GitHub
75. Security Researcher Drops VirtualBox Guest-to-Host Escape Zero-Day on GitHub
76. WordPress Flaw Opens Millions of WooCommerce Shops to Takeover
77. Rapidly Growing Router Botnet Takes Advantage of 5-Year-Old Flaw
78. Flaw Leads to RCE in WordPress Plugins, WooCommerce
79. Hacker education, inclusivity, and shifting perceptions of bug bounties
80. Apache alerts developers of remote code execution flaw
81. Evernote Flaw Allows Hackers to Steal Files, Execute Commands
82. Top 20 application vulnerabilities in the enterprise are dominated by Adobe and Microsoft
83. Equifax nemesis Apache Struts found vulnerable to 2-year old unpatched flaw; workaround available
84. Rapid7 Wins Frost & Sullivan 2018 Global Vulnerability Management Market Leadership Award
85. Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online
86. Zero-day flaw in VirtualBox details go public
87. Erratic Windows 10 Bug Breaks Changing of Default File Associations
88. Researcher discloses VirtualBox Zero-Day without reporting it to Oracle
89. Serious XSS flaw discovered in Evernote for Windows, update now!
90. Researchers say #Bleedingbit vulnerabilities could allow #RemoteCodeExecution on wireless access points, medical devices and any other products using the affected
91. Enterprises Sinking Under 100+ Critical Flaws Per Day
92. WordPress, WooCommerce flaws combine to allow website hijacking
93. Apache Struts vulnerability would allow system take over
94. Up to 4 million online merchants who use the popular @WooCommerce #WordPress plugin are vulnerable to a file deletion flaw.
95. Researcher Drops Oracle VirtualBox Zero-Day
96. Stop us if you've heard this one: Remote code hijacking flaw in Apache Struts, patch ASAP
97. Bug bounty: Hack the US Air Force and Get Paid
98. Microsoft, Google apps feature in the top 20 vulnerabilities in enterprise environments
99. VirtualBox zero-day published by disgruntled researcher
100. A fresh #botnet is rapidly growing by targeting a five-year-old #vulnerability. So far, @360Netlab said hundreds of thousands of bot
101. .@Siemens SICLOCK central plant clocks were recently found to be affected by several vulnerabilities, some of which have been rated
102. Apache Struts users have to update FileUpload library to fix years-old flaws
103. Zero-Day #Vulnerability Explained
104. November Android Security Update Fixes Critical Bugs, Drops Media Library
105. Researcher publishes new VirtualBox zero-day vulnerability
106. Vulnerabilities in self encrypted SSD allow attackers to bypass disk encryption
107. #Virtualbox hat eine #Zeroday Sicherheitslücke. Tipp: Ändern Sie Ihren virtuellen Netzwerkadapter auf etwas anderes als Intel PRO/1000.
108. Popular WooCommerce WordPress Plugin Patches Critical Vulnerability
109. Google's automated fuzz bot has found over 9,000 bugs in the past two years
110. VirtualBox Zero-Day Vulnerability Details and Exploit Are Publicly Available