News – August 2020


  • Iranian hacker group becomes first known APT to weaponize DNS-over-HTTPS (DoH)

    August 4, 2020

    An Iranian hacking group known as Oilrig has become the first publicly known threat actor to incorporate the DNS-over-HTTPS (DoH) protocol in its attacks. Speaking in a webinar last week, Vincente Diaz, a malware analyst for antivirus maker Kaspersky, said the change happened in May this year when Oilrig added a new tool to its hacking ...

  • Unveiling the Hidden Risks of Industrial Automation Programming

    August 4, 2020

    Robots and other programmable industrial machines are the backbone of the manufacturing industry. Without them, the large-scale and fast-paced production that our modern economy depends on would simply be impossible. Critical sectors — from automotive and avionics to pharmaceuticals and food production — are reliant on these machines for the precise and efficient actions that ...

  • INTERPOL report shows alarming rate of cyberattacks during COVID-19

    August 4, 2020

    An INTERPOL assessment of the impact of COVID-19 on cybercrime has shown a significant target shift from individuals and small businesses to major corporations, governments and critical infrastructure. With organizations and businesses rapidly deploying remote systems and networks to support staff working from home, criminals are also taking advantage of increased security vulnerabilities to steal data, ...

  • Vulnerable perimeter devices: a huge attack surface

    August 4, 2020

    With the increase of critical gateway devices deployed to support off-premise work, companies across the world have to adapt to a new threat landscape where perimeter and remote access devices are now in the first line. Companies lack visibility into the growing network of internet-connected services and devices that support the new work paradigm; and the ...

  • WastedLocker ransomware abuses Windows feature to evade detection

    August 4, 2020

    The WastedLocker ransomware is abusing a Windows memory management feature to evade detection by security software. Before we get to how WastedLocker is evading detection, it is necessary to understand how anti-ransomware solutions detect ransomware. Anti-ransomware solutions will monitor the operating system for file system calls traditionally used by ransomware when encrypting a file. Read more… Source: Bleeping Computer  

  • Netgear Won’t Patch 45 Router Models Vulnerable to Serious Flaw

    August 4, 2020

    Netgear will not patch 45 router models that are vulnerable to a high-severity remote code execution flaw, the router company revealed last week. However, the company says that routers that won’t receive updates are outdated or have reached EOL (End of Life). The remote code execution vulnerability in question, which was disclosed June 15, allows network-adjacent ...

  • Twitter Could Face $250M FTC Fine Over Improper Data Use

    August 4, 2020

    Twitter may be facing a Federal Trade Commission (FTC) fine of up to $250 million, after the social media giant last year revealed the improper use of users’ email addresses and phone numbers. In October 2019, Twitter acknowledged that user phone numbers and email addresses gathered for security purposes, as part of its two-factor authentication (2FA) ...

  • UK: Russian hackers stole trade papers from Liam Fox email

    August 3, 2020

    Documents on UK-US trade talks, leaked ahead of the 2019 general election, were stolen from an email account belonging to Conservative MP Liam Fox, it has emerged. The papers were published online and used by Labour in the 2019 campaign to claim the NHS would be put at risk. The UK government has said Russians almost certainly ...

  • CISA, DOD, FBI expose new versions of Chinese malware strain named Taidoor

    August 3, 2020

    Three agencies of the US government have published today a joint alert alerting US private entities about new versions of Taidoor, a malware family previously associated with Chinese state-sponsored hackers. The alert has been authored by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (DHS CISA), the Department of Defense’s Cyber Command (CyberCom), and ...

  • GandCrab ransomware distributor arrested in Belarus

    August 3, 2020

    In a press release last week, the Minister of Internal Affairs of Belarus announced the arrest of a 31-year-old man on charges of distributing the GandCrab ransomware. The man, whose name was not released, was arrested in Gomel, a small city in southeastern Belarus, at the intersection with the Russian and Ukraine border. Authorities said the man ...

  • FBI sees surge in online shopping scams, FTC says most reports ever

    August 3, 2020

    The U.S. Federal Bureau of Investigation (FBI) today warned of an increased number of reports coming from victims of online shopping scams. The public service announcement, published on the agency’s Internet Crime Complaint Center (IC3), says that the scam victims report that they found the scammers’ websites either via direct searches on popular web search engines ...

  • Take a “NetWalk” on the Wild Side

    August 3, 2020

    The NetWalker ransomware, initially known as Mailto, was first detected in August 2019. Since then, new variants were discovered throughout 2019 and the beginning of 2020, with a strong uptick noticed in March of this year. NetWalker has noticeably evolved to a more stable and robust ransomware-as-a-service (RaaS) model, and our research suggests that the malware ...

  • Google: Eleven zero-days detected in the wild in the first half of 2020

    August 3, 2020

    According to data collected by Google’s Project Zero security team, there have been 11 zero-day vulnerabilities exploited in the wild in the first half of the year. The current number puts 2020 on track to have just as many zero-days as 2019 when Google security researchers said they tracked 20 zero-days all of last year. Details about ...

  • How the FBI tracked down the Twitter hackers

    August 1, 2020

    After earlier today US law enforcement charged three individuals for the recent Twitter hack, with the help of court documents released by the DOJ, ZDNet was able to piece together a timeline of the hack, and how US investigators tracked down the three suspected hackers. The article below uses data from three indictments published today by the ...

  • WastedLocker: technical analysis

    July 31, 2020

    The use of crypto-ransomware in targeted attacks has become an ordinary occurrence lately: new incidents are being reported every month, sometimes even more often. On July 23, Garmin, a major manufacturer of navigation equipment and smart devices, including smart watches and bracelets, experienced a massive service outage. As confirmed by an official statement later, the cause ...