News – February 2021


  • Lakehead University shuts down campus network after cyberattack

    February 21, 2021

    Canadian undergraduate research university Lakehead has been dealing with a cyberattack that forced the institution earlier this week to cut off access to its servers. The school’s services, including its website, have been down since Tuesday, with personnel shutting down computers on the Thunder Bay and Orillia campuses to stop the attack from spreading. In a communication ...

  • Recently fixed Windows zero-day actively exploited since mid-2020

    February 20, 2021

    Microsoft says that a high-severity Windows zero-day vulnerability patched during the February 2021 Patch Tuesday was exploited in the wild since at least the summer of 2020 according to its telemetry data. The actively exploited zero-day bug is tracked as ‘CVE-2021-1732 – Windows Win32k Elevation of Privilege Vulnerability.’ It allows local attackers to elevate their privileges to ...

  • Experian challenged over massive data leak in Brazil

    February 20, 2021

    After receiving feedback from Experian over a massive data leak in Brazil, São Paulo state consumer rights foundation Procon described the company’s explanations as “insufficient” and said it is likely that the incident was initiated in a corporate environment. Procon notified the credit information multinational following the emergence of a leak that exposed the personal data ...

  • SonicWall releases additional update for SMA 100 vulnerability

    February 20, 2021

    SonicWall has released a second firmware update for an SMA-100 zero-day vulnerability known to be used in attacks and is warning to install it immediately. Last month, SonicWall disclosed that their internal systems were attacked using a zero-day vulnerability in their SMA-100 remote access devices. A week later, cybersecurity firm NCC Group discovered the zero-day vulnerability used ...

  • Malaysia arrests 11 suspects for hacking government sites

    February 19, 2021

    Malaysian officials announced on Thursday the arrest of 11 suspects believed to be part of a hacktivist group that defaced government websites during late January. The group, calling itself Anonymous Malaysia, defaced 17 websites for local governments and universities, according to posts they made on a Facebook page earlier this month. The defacements were part of a ...

  • IronNetInjector: Turla’s New Malware Loading Tool

    February 19, 2021

    In recent years, more and more ready-made malware is released on software development hosting sites available for everybody to use – including threat actors. This not only saves the bad guys development time, but also makes it much easier for them to find new ideas to prevent detection of their malware. Unit 42 researchers have found ...

  • Microsoft: SolarWinds Attackers Downloaded Azure, Exchange Code

    February 19, 2021

    Threat actors downloaded some Microsoft Exchange and Azure code repositories during the sprawling SolarWinds supply-chain attack but did not use the company’s internal systems or products to attack other victims. That’s the final verdict this week by the tech giant now that it’s completed a comprehensive investigation into the attack, which was discovered in December and ...

  • Silver Sparrow Malware Found Nesting on 30K Macs

    February 19, 2021

    Hard on the heels of a macOS adware being recompiled to target Apple’s new in-house processor, researchers have discovered a brand-new family of malware targeting the platform. Curiously, in the samples seen so far by analysts at Red Canary, the malware (dubbed Silver Sparrow) has been executing on victim machines with the final payload yet to ...

  • Malformed URL Prefix Phishing Attacks Spike 6,000%

    February 19, 2021

    Researchers from GreatHorn report they have observed a nearly 6,000-percent jump in attacks using “malformed URL prefixes” to evade protections and deliver phishing emails that look legit. They look legit, that is, unless you look closely at the symbols used in the prefix before the URL. “The URLs are malformed, not utilizing the normal URL protocols, ...

  • Gauging LoRaWAN Communication Security with LoraPWN

    February 19, 2021

    LoRaWAN technology allows organizations to deploy the internet of things solutions at a much lower cost than existing cellular infrastructure solutions. Because of this, enterprises and smart cities around the world have started using LoRaWAN in their operations. As mentioned in the first article of this series, LoRaWAN technology has been used in infrastructure management, ...

  • Industrial Remote Access: Why It’s Not Something to Fear

    February 18, 2021

    Increased uptime? Check. Better access to outside expertise? Check. Improved first-time-fix rate? Check. These are just some of the benefits of industrial remote access. Yet many customers are reluctant to embrace remote access. Not only that, but incidents such as the breach at the Oldsmar water utility might increase organizations’ reluctance to use remote access. Using Oldsmar ...

  • Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device

    February 17, 2021

    In 2019, Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user. Specifically, Mandiant’s research focused on SolarCity’s (now owned by Tesla) rebranded ConnectPort X2e device, which is used in residential solar installations. Mandiant performs this type of work both ...

  • Manufacturing Cybersecurity Case Studies

    February 17, 2021

    Manufacturing is a large industry that plays an important role in the world economy and is closely linked to our daily lives. They produce a variety of products, such as automobiles and semiconductors, industrial equipment, steel, oil, cement, food and pharmaceuticals. Each company has a different environment and different cybersecurity challenges. Trend Micro classifies their ...

  • Singtel breach compromises data of customers, former employees

    February 17, 2021

    Singtel has confirmed that personal details of 129,000 customers, as well as financial information of its former employees, have been compromised in a security breach that involved a third-party file-sharing system. Credit card details belonging to the staff of a corporate client and information tied to 23 enterprises, including suppliers and partners, also have been ...

  • Australian Department of Defence lists cyber mitigation as key factor for building ethical AI

    February 17, 2021

    The Australian Department of Defence has released a new report on its findings for how to reduce the ethical risk of artificial intelligence projects, noting that cyber mitigation will be key to maintaining the trust and integrity of autonomous systems. The report was drafted following concerns from Defence that failure to adopt emerging technologies in a ...

  • Rising healthcare breaches driven by hacking and unsecured servers

    February 17, 2021

    2020 was a bad year for healthcare organizations in the U.S., which had to deal with a record-high number of cybersecurity incidents on the backdrop of the COVID-19 pandemic. Hacking and IT incidents affected the industry to a larger extent last year, accounting for more than 67% of all breaches and exposed the personal data of ...

  • Masslogger Swipes Microsoft Outlook, Google Chrome Credentials

    February 17, 2021

    Cybercriminals are targeting Windows users with a new variant of the Masslogger trojan, which is spyware designed to swipe victims’ credentials from Microsoft Outlook, Google Chrome and various instant-messenger accounts. Researchers uncovered the campaign targeting users in Italy, Latvia and Turkey starting in mid-January. When the Masslogger variant launched its infection chain, it disguised its malicious ...

  • U.S. Accuses North Korean Hackers of Stealing Millions

    February 17, 2021

    The U.S. Department of Justice has indicted three North Korean computer programmers for their alleged participation in widespread, destructive cyberattacks as part of the advanced persistent threat (APT) known as Lazarus Group. The indictment broadens the scope of crimes that the DoJ has linked to Lazarus Group (and by extension, to North Korea). The feds also ...

  • Kia Motors America suffers ransomware attack, $20 million ransom

    February 17, 2021

    Kia Motors America has suffered a ransomware attack by the DoppelPaymer gang, demanding $20 million for a decryptor and not to leak stolen data. Kia Motors America (KMA) is headquartered in Irvine, California, and is a Kia Motors Corporation subsidiary. KMA has nearly 800 dealers in the USA with cars and SUVs manufactured out of West ...

  • Details Tied to Safari Browser-based ‘ScamClub’ Campaign Revealed

    February 17, 2021

    Details of a flaw in Apple’s Safari browser, publicly disclosed Tuesday, outline how the cybergang known as ScamClub reached 50 million users with a three-month-long malicious ad campaign pushing malware to mobile iOS Chrome and macOS desktop browsers. The Safari bug, patched on Dec. 2 by Apple, was exploited by a malvertising campaign that redirected traffic ...