News – February 2021


  • Npower withdraws mobile app after hackers steal personal details

    February 27, 2021

    Npower has permanently withdrawn its mobile app after hackers used it to access its customers’ personal details, including the sort codes and the last four digits of their bank accounts. The hack, which cybersecurity experts said left the firm’s customers “wide open to fraud”, is understood to have taken place around the start of February. The company ...

  • Go malware is now common, having been adopted by both APTs and e-crime groups

    February 26, 2021

    The number of malware strains coded in the Go programming language has seen a sharp increase of around 2,000% over the last few years, since 2017, cybersecurity firm Intezer said in a report published this week. The company’s findings highlight and confirm a general trend in the malware ecosystem, where malware authors have slowly moved away ...

  • Oxford University lab with COVID-19 research links targeted by hackers

    February 26, 2021

    An Oxford University lab conducting research into the coronavirus pandemic has been compromised by cyberattackers. Oxford University, one of the most prominent educational institutions in the UK, was made aware of the security breach on Thursday. The university confirmed that a security incident took place at the Division of Structural Biology lab, also known as “Strubi,” after ...

  • Dutch Research Council (NWO) confirms ransomware attack, data leak

    February 26, 2021

    The recent cyberattack that forced the Dutch Research Council (NWO) to take its servers offline and suspend grant allocation processes was caused by the DoppelPaymer ransomware gang. The hackers gained access to NWO’s network on February 8 and stole internal documents, threatening with leaking them unless the organization paid a ransom. Since NWO does not cooperate with ...

  • Lazarus targets defense industry with ThreatNeedle

    February 25, 2021

    We named Lazarus the most active group of 2020. We’ve observed numerous activities by this notorious APT group targeting various industries. The group has changed target depending on the primary objective. Google TAG has recently published a post about a campaign by Lazarus targeting security researchers. After taking a closer look, we identified the malware ...

  • Cisco Warns of Critical Auth-Bypass Security Flaw

    February 25, 2021

    A critical vulnerability in Cisco Systems’ intersite policy manager software could allow a remote attacker to bypass authentication. The vulnerability is one of three critical flaws fixed by Cisco on this week. It exists in Cisco’s ACI Multi-Site Orchestrator (ACI MSO) — this is Cisco’s management software for businesses, which allows them to monitor the health ...

  • Health Website Leaks 8 Million COVID-19 Test Results

    February 25, 2021

    Yet another human-related error — this time a flaw in a health department website in the state of Bengal, India — has exposed the confidential results of COVID-19 tests as well as personally identifying information (PII) for an entire geographic region’s population. Test results related to more than 8 million people potentially were exposed before the ...

  • GCHQ: Artificial intelligence is already a vital part of our missions

    February 25, 2021

    The UK’s top intelligence and security body, GCHQ, is betting big on artificial intelligence: the organization has revealed how it wants to use AI to boost national security. In a new paper titled “Pioneering a New National Security,” GCHQ’s analysts went to lengths to explain why AI holds the key to better protection of the nation. ...

  • TD Bank suffered systemwide banking outage, services now recovered

    February 25, 2021

    TD Bank has recovered from a major IT systems outage today that prevented account holders from accessing their online bank accounts, use ATM, or check balances over the phone. The outage started at approximately 2 AM EST this morning and prevented TD Bank members from logging into their online accounts. When attempting to do so, their systems ...

  • So Unchill: Melting UNC2198 ICEDID to Ransomware Operations

    February 25, 2021

    Mandiant Advanced Practices (AP) closely tracks the shifting tactics, techniques, and procedures (TTPs) of financially motivated groups who severely disrupt organizations with ransomware. In May 2020, FireEye released a blog post detailing intrusion tradecraft associated with the deployment of MAZE. As of publishing this post, we track 11 distinct groups that have deployed MAZE ransomware. ...

  • ENISA Releases Guidelines for Cloud Security for Healthcare Services

    February 25, 2021

    The healthcare sector is undergoing digitalization and adopts new technologies to improve patient care, offer new services for remote patients and reach operational excellence. The integration of new technologies in the complex healthcare IT infrastructure creates new challenges regarding data protection and cybersecurity. On the one hand, the COVID-19 pandemic has been a driver for increased ...

  • Security Risks for Audio-centric Social Media Apps

    February 24, 2021

    The use of audio-only social media apps such as ClubHouse, Riffr, Listen, Audlist, and HearMeOut has been steadily capturing the interest of more and more users over the recent years. But just like any other technology, apps like these are not immune from security risks. Furthermore, most of these risks can be automated, helping attackers ...

  • COVID pandemic causes spike in cyberattacks against hospitals, medical companies

    February 24, 2021

    Cyberattacks against healthcare organizations have doubled during the coronavirus pandemic, research suggests. On Wednesday, IBM released the company’s annual X-Force Threat Intelligence Index, which analyzed data from the previous year to track the evolution of new threats, malware development, and cyberattacks. The 2021 index includes some notable trends, perhaps the most significant being how many threat actors ...

  • CISA Alert (AA21-055A): Exploitation of Accellion File Transfer Appliance

    February 24, 2021

    This joint advisory is the result of a collaborative effort by the cybersecurity authorities of Australia, This activity has impacted organizations globally, including those in Australia, New Zealand, Singapore, the ...

  • APT32 state hackers target human rights defenders with spyware

    February 23, 2021

    Vietnam-backed hacking group APT32 has coordinated several spyware attacks targeting Vietnamese human rights defenders (HRDs) between February 2018 and November 2020. The state hackers also pointed their attacks at a nonprofit (NPO) human rights organization from Vietnam, as Amnesty International’s Security Lab revealed (full report here). The spyware used by the APT32 hackers allowed them to read ...

  • Airplane maker Bombardier data posted on ransomware leak site following FTA hack

    February 23, 2021

    Canadian airplane manufacturer Bombardier has disclosed today a security breach after some of its data was published on a dark web portal operated by the Clop ransomware gang. “An initial investigation revealed that an unauthorized party accessed and extracted data by exploiting a vulnerability affecting a third-party file-transfer application, which was running on purpose-built servers isolated ...

  • Finnish IT Giant Hit with Ransomware Cyberattack

    February 23, 2021

    Norwegian business journal E24 reported the attack on Espoo, Finland-based TietoEVRY on Tuesday, claiming to have spoken with Geir Remman, a communications director at the company. Remman acknowledged technical problems with several services that TietoEVRY provides to 25 customers, which are “due to a ransom attack,” according to the report. Remman told E24 that the company ...

  • Accellion FTA Zero-Day Attacks Show Ties to Clop Ransomware, FIN11

    February 22, 2021

    Researchers have identified a set of threat actors (dubbed UNC2546 and UNC2582) with connections to the FIN11 and the Clop ransomware gang as the cybercriminal group behind the global zero-day attacks on users of the Accellion legacy File Transfer Appliance product. Multiple Accellion FTA customers, including the Jones Day Law Firm, Kroger and Singtel, have all ...

  • TDoS Attacks Take Aim at Emergency First-Responder Services

    February 22, 2021

    Telephony denial-of-service (TDoS) attacks, which affect the availability and readiness of call centers, are hitting critical first-responder facilities, according to the Federal Bureau of Investigation (FBI). A TDoS attack is designed to prevent incoming and outgoing calls, by flooding a target with junk calls. “The objective is to keep the distraction calls active for as long as ...

  • Chinese hackers cloned attack tool belonging to NSA’s Equation Group

    February 22, 2021

    Chinese threat actors “cloned” and used a Windows zero-day exploit stolen from the NSA’s Equation Group for years before the privilege escalation flaw was patched, researchers say. On Monday, Check Point Research (CPR) said the tool was a “clone” of software developed by the US National Security Agency (NSA)’s Equation Group, identified by FireEye in 2015 ...