News – March 2019


  • UK cyber-security efforts criticised by audit office

    March 15, 2019

    The government has been told there are “failings” in the way it is planning to protect the UK’s critical infrastructure from cyber-attacks. The warning came in a National Audit Office (NAO) assessment of the UK’s national cyber-defence plan. The government is increasingly worried that these essential sectors will be targeted by foreign states seeking to disrupt UK ...

  • ASD reveals rules for keeping vulnerabilities secret

    March 15, 2019

    The Australian Signals Directorate (ASD) has quietly published its process for deciding when knowledge of cybersecurity vulnerabilities is kept secret. This is the first official acknowledgement that the ASD might not disclose all of the vulnerabilities it discovers. However, knowledge of secret vulnerabilities would have always been an essential part the agency’s toolkit for offensive cyber ...

  • Patched WinRAR Bug Still Under Active Attack – Thanks to No Auto-Updates

    March 15, 2019

    Various cyber criminal groups and individual hackers are still exploiting a recently patched critical code execution vulnerability in WinRAR, a popular Windows file compression application with 500 million users worldwide. Why? Because the WinRAR software doesn’t have an auto-update feature, which, unfortunately, leaves millions of its users vulnerable to cyber attacks. The critical vulnerability (CVE-2018-20250) that was patched ...

  • Disrupting the Attack Chain Through Detecting Credential Dumping

    March 15, 2019

    There are various steps that an attacker must follow in order to execute any successful attack, with the initial compromise being just one stage in the overall attack chain. Once attackers have successfully breached the perimeter of an organization, they enter into the lateral movement phase where they attempt to tiptoe through a network, identifying ...

  • IMAP-Based Attacks Compromising Accounts at ‘Unprecedented Scale’

    March 14, 2019

    That’s according to researchers with Proofpoint, who found that in the past half year, a staggering 60 percent of Microsoft Office 365 and G Suite tenants have been targeted with IMAP-based password-spraying attacks; and 25 percent of those targeted experienced a full-on breach as a result. Password-spraying attacks are when an attacker attempts to access a large ...

  • Talking to RATs: Assessing Corporate Risk by Analyzing Remote Access Trojan Infections

    March 14, 2019

    Remote access trojans (RATs) on a corporate system may serve as a key pivot point to access information laterally within an enterprise network. By analyzing network metadata, Recorded Future analysts were able to identify RAT command-and-control (C2) servers, and more crucially, which corporate networks were communicating to those controllers. This approach allows Recorded Future to ...

  • Businesses warned over a new breed of BitLocker attacks

    March 14, 2019

    Devices protected using Microsoft BitLocker can be physically breached in a new form of attack that involves extracting the encryption keys from a computer’s Trusted Platform Module (TPM) chip. By hardwiring equipment into a computer’s motherboard, namely the TPM chip, attackers would be primed to access any sensitive corporate information stored on encrypted hard drives. This ...

  • The fourth horseman: CVE-2019-0797 vulnerability

    March 13, 2019

    The new zero-day in the Windows OS exploited in targeted attacks In February 2019, our Automatic Exploit Prevention (AEP) systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis of this event led to us discovering a zero-day vulnerability in win32k.sys. We reported it to Microsoft on February 22, 2019. ...

  • Yatron Ransomware Plans to Spread Using EternalBlue NSA Exploits

    March 12, 2019

    A new Ransomware-as-a-Service called Yatron is being promoted on Twitter that plans on using the EternalBlue and DoublePulsar exploits to spread to other computer on a network. This ransomware will also attempt to delete encrypted files if a payment has not been made in 72 hours. BleepingComputer was first notified about the Yatron RaaS by a security ...

  • From Fileless Techniques to Using Steganography: Examining Powload’s Evolution

    March 12, 2019

    Powload’s staying power in the threat landscape shows how far it has come. In fact, the uptick of macro malware in the first half of 2018 was due to Powload, which was distributed via spam emails. Powload was also one of the most pervasive threats in the North American region in 2018, using various techniques to deliver payloads such ...

  • Island hopping: The latest security threat you should be aware of

    March 12, 2019

    While island hopping sounds like a great way to spend a holiday in Thailand or Greece, the term also refers to an advanced cyber attack technique. Though it’s not a new phenomenon, this type of attack increased in prevalence in 2018 and will likely become more and more common. The name ‘island hopping’ comes from a WWII ...

  • North Korean Hackers Behind $571M Crypto Heists Says UN Report

    March 12, 2019

    North Korean backed hacking groups were behind multiple cyberattacks impacting financial institutions and cryptocurrency exchanges as detailed in a report issued by a panel of experts for the United Nations (UN) Security Council. According to the report provided by the panel which comes as a confirmation of what security researchers have previously reported, “cyberspace is used by the DPRK as ...

  • New SLUB Backdoor Uses GitHub, Communicates via Slack

    March 11, 2019

    In mid-February, Kaspersky Lab received a request for incident response from one of its clients. The individual who initially reported the issue to our client refused to disclose the origin of the indicator that they shared. What we do know is that it was a screenshot from one of the client’s internal computers taken on ...

  • NASA’s crap infosec could be ‘significant threat’ to space ops

    March 11, 2019

    NASA’s Office of the Inspector General has once again concluded the American space agency’s tech security practices are “not consistently implemented”. Confirmation that the US government department’s infosec abilities are not up to scratch was a repeat of last year’s federally mandated security audit, which also found that processes and procedures were below par. Oversight personnel from ...

  • Citrix Data Breach – Iranian Hackers Stole 6TB of Sensitive Data

    March 11, 2019

    Popular enterprise software company Citrix that provides services to the U.S. military, the FBI, many U.S. corporations, and various U.S. government agencies disclosed last weekend a massive data breach of its internal network by “international cyber criminals.” Citrix said it was warned by the FBI on Wednesday of foreign hackers compromising its IT systems and stealing ...

  • Georgia county pays a whopping $400,000 to get rid of a ransomware infection

    March 9, 2019

    Officials in Jackson County, Georgia, paid $400,000 to cyber-criminals this week to get rid of a ransomware infection and regain access to their IT systems. The ransomware hit the county’s internal network last week, on Friday, March 1, 11Alive reported on Wednesday. The infection forced most of the local government’s IT systems offline, with the exception of its website and 911 ...

  • Operational Technology Widens Supply Chain Attack Surfaces

    March 8, 2019

    Today’s supply chain has evolved, with operational technology (OT) used in factories increasingly becoming connected and converging with IT systems — introducing new attack vectors. This new reality is vital for companies to understand in the context of risk, according to Dawn Cappelli, vice president of global security and CISO at Rockwell Automation and Edna Conway, ...

  • Email verification service takes itself offline after 800 million records get publicly exposed

    March 8, 2019

    An online email verification service has taken itself offline after approximately 809 million of its customers’ emails were exposed through an unprotected server. Researchers discovered a non-password protected MongoDB instance amounting to 150GB of data split across four separate collections last week. They analysed this exposed data, 808,593,939 records in total, and published their findings on Thursday. The exposed ...

  • New SLUB Backdoor Uses GitHub, Communicates via Slack

    March 7, 2019

    We recently came across a previously unknown malware that piqued our interest in multiple ways. For starters, we discovered it being spread via watering hole attacks, a technique that involves an attacker compromising a website before adding code to it so visitors are redirected to the infecting code. In this case, each visitor is redirected only ...

  • Whitefly: Espionage Group has Singapore in Its Sights

    March 6, 2019

    Group behind the SingHealth breach is also responsible for a string of other attacks in the region. In July 2018, an attack on Singapore’s largest public health organization, SingHealth, resulted in a reported 1.5 million patient records being stolen. Until now, nothing was known about who was responsible for this attack. Symantec researchers have discovered that ...