News – November 2019


  • IT threat evolution Q3 2019

    November 29, 2019

    Targeted attacks and malware campaigns, Mobile espionage targeting the Middle East At the end of June Kaspersky reported the details of a highly targeted campaign that we dubbed ‘Operation ViceLeaker’ involving the spread of malicious Android samples via instant messaging. The campaign affected several dozen victims in Israel and Iran. We discovered this activity in May ...

  • Operation ENDTRADE: Finding Multi-Stage Backdoors that TICK

    November 29, 2019

    While we have been following cyberespionage group TICK (a.k.a. “BRONZE BUTLER” or “REDBALDKNIGHT”) since 2008, we noticed an unusual increase in malware development and deployments towards November 2018. We already know that the group uses previously deployed malware and modified tools for obfuscation, but we also found TICK developing new malware families capable of detection ...

  • NCA: Cyber-crime site selling hacking tool taken down following international operation

    November 29, 2019

    A website which sold a hacking tool purchased by cyber criminals in 124 countries and gave full remote control of victims’ computers has been taken down following an international investigation. 14,500 people across the world purchased the Imminent Monitor Remote Access Trojan (IM RAT) from https://imminentmethods.net for as little as US$25. Once covertly installed on a victim’s computer, IM ...

  • Ransomware: Big paydays and little chance of getting caught means boom time for crooks

    November 29, 2019

    Ransomware will continue to plague organisations in 2020 because there’s little risk of the cyber criminals behind the network-encrypting malware attacks getting caught; so for them there’s only a small amount of risk, but a potentially large reward. During the last year, there’s been many examples of ransomware attacks where victims have given into the extortion demands of ...

  • Hotel front desks are now a hotbed for hackers

    November 28, 2019

    It seems that any possible way cybercriminals can exploit the hospitality industry, they will. Hotels, restaurant chains, and related tourism services have been subject to a range of techniques when it comes to cybercrime; the compromise of Point-of-Sale (PoS) terminals to harvest guest data, phishing emails sent to staff which are designed to give attackers access ...

  • Cyber security skills shortage near breaking point

    November 27, 2019

    The UK’s widening cyber skills gap is putting the country’s businesses at risk, with uncertainty around Brexit is also proving to be a huge concern for recruitment in the field. This is according to research from cyber security consultancy RedSeal, which ran an online survey of 502 IT decision-makers from across the country. Within it, 95% of CIOs and ...

  • NSO Group President Defends Controversial Tactics

    November 27, 2019

    In a rare public appearance by Shiri Dolev, the president of the secretive NSO Group Technologies, the company leader vented over what she called “false myths” about the firm. Dolev also took indirect aim at secure messaging platforms, offered by the likes of Facebook, explaining surveillance companies may soon have to step in where law ...

  • Exploit code published for dangerous Apache Solr remote code execution flaw

    November 25, 2019

    Confusion still surrounds a security bug that the Apache Solr team patched over the summer, which turns out it’s actually much more dangerous than anyone thought. Apache Solr is a Java-based open-source search engine, initially developed to add search functionality to the CNET website. The project was donated to the Apache Software Foundation in 2006, from where ...

  • Trickbot Appears to Target OpenSSH and OpenVPN Data in Upgraded Password-Grabbing Module

    November 25, 2019

    Trickbot first arrived on the scene in 2016, its initial iteration being a banking trojan that infected computers to steal email passwords and address books to spread malicious emails from compromised accounts. A few years and multiple transformations later, what was a simple banking trojan has since mutated into a constantly evolving malware family that includes information ...

  • Unwanted notifications in browser

    November 25, 2019

    When, back in 2015, push notifications were just appearing in browsers, very few people wondered how this tool would be used in the future: once a useful technology made to keep regular readers informed about updates, today it is often used to shell website visitors with unsolicited ads. To achieve that, users are hoaxed into ...

  • Extensive hacking operation discovered in Kazakhstan

    November 23, 2019

    Chinese cyber-security vendor Qihoo 360 published a report on Friday exposing an extensive hacking operation targeting the country of Kazakhstan. Targets included individuals and organizations involving all walks of life, such as government agencies, military personnel, foreign diplomats, researchers, journalists, private companies, the educational sector, religious figures, government dissidents, and foreign diplomats alike. The campaign, Qihoo 360 ...

  • Google Will Award $1M-Plus to People Who Can Hack Titan M Security Chip

    November 22, 2019

    Google is willing to award up to $1.5 million to hackers who can successfully hack its Titan M security chip on the company’s Pixel devices as part of an expansion of its Android bug-bounty program unveiled this week. The company revealed increased payouts to its Android Security Rewards in a blog post Thursday. Google already has paid out ...

  • Critical Flaws in VNC Threaten Industrial Environments

    November 22, 2019

    The open-source Virtual Network Computing (VNC) project, often found in industrial environments, is plagued with 37 different memory-corruption vulnerabilities – many of which are critical in severity and some of which could result in remote code execution (RCE). According to researchers at Kaspersky, they potentially affect 600,000 web-accessible servers in systems that use the code. The ...

  • DePriMon downloader uses novel ways to infect your PC with ColoredLambert malware

    November 21, 2019

    A malware downloader has been spotted using novel “Port Monitor” methods that have not been detected before in active campaigns. Dubbed DePriMon, the malicious downloader is used to deploy malware used by Lambert — also known as the Longhorn advanced persistent threat (APT) group — which specializes in attacks against European and Middle Eastern companies. Kaspersky estimates ...

  • New SectopRAT Trojan creates hidden second desktop to control browser sessions

    November 21, 2019

    A new Trojan, SectopRAT, has appeared in the wild which is able to launch a hidden secondary desktop to control browser sessions on infected machines. The new malware was first spotted by MalwareHunterTeam. In a tweet on 15 November, MalwareHunterTeam said the C# malware, compiled on 13 November, was able to “create hidden desktop and run ...

  • High-Severity Windows UAC Flaw Enables Privilege Escalation

    November 20, 2019

    Researchers disclosed details of a high-severity Microsoft Windows vulnerability that could give attackers elevated privileges – ultimately allowing them to install programs, and view, change or delete data. The bug stems from User Account Control (UAC), a security feature of Windows within Secure Desktop which helps prevent unauthorized changes to the operating system. “With UAC fully ...

  • New Roboto botnet emerges targeting Linux servers running Webmin

    November 20, 2019

    A cybercrime group is enslaving Linux servers running vulnerable Webmin apps into a new botnet that security researchers are currently tracking under the name of Roboto. The botnet’s appearance dates back to this summer and is linked to the disclosure of a major security flaw in a web app installed on more than 215,000 servers — ...

  • Thousands of businesses vulnerable to ‘severe’ Oracle EBS flaws

    November 20, 2019

    Security researchers at Onapsis have discovered a number of ‘severe’ vulnerabilities in Oracle’s E-Business Suite (EBS) that could leave more than 21,000 organisations at risk of financial theft and fraud. Oracle EBS has become a critical set of products that help to integrate customer relationship management (CRM), enterprise resource planning (ERP) and supply chain management processes within a ...

  • House of Commons looking for new cyber security director

    November 20, 2019

    The UK House of Commons is looking to appoint a new Director of Cyber Security for the Parliamentary Digital Service. A contract notice published on the Civil Service Jobs website stated that the selected candidate will have to take overall responsibility for the Palace of Westminster’s cybersecurity strategy. Work involves maintaining awareness of both internal and external ...

  • ICS Cyberwarfare: The Latest Threat to America’s Power Grid

    November 20, 2019

    The modern world is dependent on electricity, and the United States is no exception. I remember the notorious blackouts that affected the eastern U.S. and Canada in August 2003. The duration of the mass power outage lasted anywhere between several hours and a week depending on where you were. I was in Hamilton, Canada, and ...