News – August 2019


  • Post GandCrab, Cybercriminals Scouring the Dark Web for the Next Top Ransomware

    August 19, 2019

    A detailed look at underground forums shows that cybercriminals aren’t sure where to look on the heels of the GandCrab ransomware group shutting its doors – and low-level actors are taking advantage of that by developing their own strains. Ransomware continues to be a top threat, with Friday’s ransomware attack on 23 Texas local government and agencies and two ...

  • Adwind Remote Access Trojan Hits Utilities Sector

    August 19, 2019

    Attackers are targeting entities from the utility industry with the Adwind Remote Access Trojan (RAT) malware via a malspam campaign that uses URL redirection to malicious payloads. Adwind (also known as jRAT, AlienSpy, JSocket, and Sockrat) is distributed by its developers to threat actors under a malware-as-a-service (MaaS) model and it is capable of evading detection by most major anti-malware ...

  • Uncovering a MyKings Variant With Bootloader Persistence via Managed Detection and Response

    August 19, 2019

    In May, during the Managed Detection and Response service on-boarding process of an electronics company in the Asia-Pacific region, we noticed suspicious activity via the Trend Micro™ Deep Discovery™ Inspector that turned out to be related to EternalBlue, an exploit perhaps more popularly known for being used in the WannaCry attacks. After the discovery, we sent our first alert to the ...

  • Hackers Use Fake NordVPN Website to Deliver Banking Trojan

    August 19, 2019

    The attackers who previously breached and abused the website of free multimedia editor VSDC to distribute the Win32.Bolik.2 banking Trojan have now switched their tactics. While previously they hacked legitimate websites to hijack download links infected with malware, the hackers are now creating website clones to deliver banking Trojans onto unsuspecting victims’ computers. This allows them to focus ...

  • Over 20 Texas local governments hit in ‘coordinated ransomware attack’

    August 18, 2019

    Twenty-three local Texas governments have been infected with ransomware last week in what Texas officials have described as a coordinated attack. The attack took place on Friday morning, August 16, US time, when several smaller local Texas governments reported problems with accessing their data to the Texas Department of Information Resources (DIR). DIR officials did not pubish ...

  • Router Network Isolation Broken By Covert Data Exfiltration

    August 18, 2019

    Software-based network isolation provided by routers is not as efficient as believed, as hackers can smuggle data between the networks for exfiltration. Most modern routers offer the possibility to split the network into multiple segments that work separately. One example is a guest network that works in parallel with the host. The boundary insulates sensitive or critical ...

  • 4.1B Records Exposed in Breaches in First Half of 2019

    August 16, 2019

    This year is on track to be the worst year on record for data breach activity, according to a recent analysis. Within the first six months of this year, there have been 3,813 incidents publicly reported, according to Risk Based Security’s 2019 MidYear QuickView Data Breach Report. That’s up 54 percent compared to this time last ...

  • Australian Signals Directorate launches open source​ data visualisation tool

    August 16, 2019

    The Australian Signals Directorate (ASD) has open sourced its own data visualisation and analysis software tool that it says can be used to solve large and complex problems in a “simple and intuitive way”. Constellation, available on GitHub, can be used to identify trends and patterns in complex datasets, and can handle billions of inputs, ASD ...

  • European Central Bank Shuts Down ‘BIRD Portal’ After Getting Hacked

    August 16, 2019

    The European Central Bank (ECB) confirmed Thursday that it had been hit by a cyberattack that involved attackers injecting malware into one of its websites and potentially stealing contact information of its newsletter subscribers. Headquartered in Germany, the European Central Bank (ECB) is the central bank of the 19 European Union countries which have adopted the ...

  • DanaBot banking Trojan jumps from Australia to Germany in quest for new targets

    August 15, 2019

    The DanaBot banking Trojan is on the move and has traveled across the sea in a pivot from its original focus on Australia to strike European targets. DanaBot was first discovered by Proofpoint researchers last year. The malware was observed striking Australian targets of financial value, but at the time, DanaBot appeared to come from only one threat ...

  • Analysis: New Remcos RAT Arrives Via Phishing Email

    August 15, 2019

    In July, we came across a phishing email purporting to be a new order notification, which contains a malicious attachment that leads to the remote access tool Remcos RAT (detected by Trend Micro as BKDR_SOCMER.SM). This attack delivers Remcos using an AutoIt wrapper that incorporates various obfuscation and anti-debugging techniques to evade detection, which is ...

  • The internet of things security maturity model: a nudge for IoT cybersecurity

    August 14, 2019

    Developing cyberthreat protection strategies is a challenging task, especially for industrial systems and the internet of things. Numerous parties are involved in the processes of designing, developing, integrating, using and maintaining such systems. The different parties involved will assess the risks associated with attacks differently. Some businesses may view security as a drawback (because of longer ...

  • British Airways E-Ticketing Flaw Exposes Passenger Flight, Personal Data

    August 13, 2019

    A vulnerability in British Airways’ e-ticketing system could enable a bad actor to view passengers’ personal data or change their booking information. A security bug discovered in British Airways’ e-ticketing system has the potential to expose passengers’ data, including their flight booking details and personal information. Researchers on Tuesday said that check-in links being sent by British ...

  • Back-to-Back Campaigns: Neko, Mirai, and Bashlite Malware Variants Use Various Exploits to Target Several Routers, Devices

    August 13, 2019

    Within a span of three weeks, our telemetry uncovered three notable malware variants of Neko, Mirai, and Bashlite. On July 22, 2019, we saw and started analyzing a Neko botnet sample, then observed another sample with additional exploits the following week.  A Mirai variant that calls itself “Asher” surfaced on July 30, then a Bashlite ...

  • How Threat Intelligence Helps the Energy Sector Fight Cyberespionage

    August 13, 2019

    When it comes to cyber threats, some industries have it harder than others. Few are as heavily targeted by sophisticated cyberattacks as the energy sector. Over the last decade, state-sponsored hacking groups have routinely targeted utility networks and other energy providers for the purposes of espionage and disruption. And according to the latest research, advanced persistent threat (APT) ...

  • Man jailed for cyber attacks against police websites in revenge for bomb hoax conviction

    August 12, 2019

    A 20-year-old man has been jailed for 16 months after launching cyber attacks against police websites. Liam Reece Watts used specialist software to overload the Greater Manchester Police and Cheshire Police websites in separate attacks which temporarily brought down the sites. He said the attack on Cheshire Police was in retaliation for a previous conviction over a ...

  • Hunting the Public Cloud for Exposed Hosts and Misconfigurations

    August 12, 2019

    This research explores the security landscape of the Internet-facing services hosted in Amazon AWS, Microsoft Azure and Google Cloud Platform. Public cloud is becoming increasingly popular and the reported total spending on cloud infrastructure grew 45.6% in 2018. Amazon AWS maintained its lead with a 31.3% share of the Cloud Service Provider (CSP) market, followed by Microsoft ...

  • Recent Cloud Atlas activity

    August 12, 2019

    Also known as Inception, Cloud Atlas is an actor that has a long history of cyber-espionage operations targeting industries and governmental entities. We first reported Cloud Atlas in 2014 and we’ve been following its activities ever since. From the beginning of 2019 until July, we have been able to identify different spear-phishing campaigns related to this threat actor ...

  • IT threat evolution Q2 2019: Targeted attacks and malware campaigns

    August 12, 2019

    In March, we published the results of our investigation into a sophisticated supply-chain attack involving the ASUS Live Update Utility, used to deliver BIOS, UEFI and software updates to ASUS laptops and desktops. The attackers added a backdoor to the utility and then distributed it to users through official channels. ASUS was not the only company used ...

  • Microsoft names top security researchers, zero-day contributors

    August 9, 2019

    At the Black Hat security conference in Las Vegas, Microsoft announced the top security researchers and enterprise partners who contributed the most vulnerability and zero-day reports affecting the company’s products. Microsoft’s list of top contributors has become a Black Hat tradition, and many industry experts use it as a guide to today’s top bug hunters. Security researchers ...