News – October 2021


  • Almost 100 Organizations in Brazil Targeted with Banking Trojan

    October 26, 2021

    Up to 100 organizations in Brazil have been targeted with a banking Trojan since approximately late August 2021, with the most recent activity seen in early October. This campaign appears to be a continuation of activity that was published about by researchers at ESET in 2020. The attackers appeared to be undeterred by exposure and Symantec, ...

  • Third-party data breach in Singapore hits healthcare provider

    October 26, 2021

    Another third-party security breach has been reported in Singapore, this time, affecting patients of Fullerton Health and compromising personal data that included bank account details in “a few cases”. The affected vendor Agape Connecting People, which platform facilitates appointment booking, first detected the breach on October 19 and appeared to affect only Fullerton Health. The healthcare ...

  • Ransomware has proliferated because it’s ‘largely uncontested’, says GCHQ boss

    October 26, 2021

    If you’ve wondered why ransomware has proliferated in recent years, it’s because until recently it has remained unchallenged, according to Sir Jeremy Fleming, director of British signals intelligence agency GCHQ. “We’ve seen twice as many attacks this year as last year in the UK – but the reason it is proliferating is because it works,” ...

  • NOBELIUM targeting delegated administrative privileges to facilitate broader attacks

    October 25, 2021

    The Microsoft Threat Intelligence Center (MSTIC) has detected nation-state activity associated with the threat actor tracked as NOBELIUM, attempting to gain access to downstream customers of multiple cloud service providers (CSP), managed service providers (MSP), and other IT services organizations (referred to as “service providers” for the rest of this blog) that have been granted ...

  • Ransomware: Industrial services top the hit list – but cyber criminals are diversifying

    October 25, 2021

    Businesses in industrial goods and services are still the most popular target for ransomware attacks, but cyber criminals are increasingly diversifying which organisations they’re extorting. Ransomware has become a major cybersecurity issue, as cyber criminals infiltrate networks and encrypt servers and files before demanding a ransom payment – often amounting to millions of dollars in cryptocurrencies ...

  • CISA: Critical RCE Vulnerability in Discourse

    October 24, 2021

    Discourse—an open source discussion platform—has released a security advisory to address a critical remote code execution (RCE) vulnerability (CVE-2021-41163) in Discourse versions 2.7.8 and earlier. CISA urges developers to update to patched versions 2.7.9 or later or apply the necessary workarounds. Read more… Source: U.S. Cybersecurity and Infrastructure Security Agency  

  • Hacker sells the data for millions of Moscow drivers for $800

    October 23, 2021

    Hackers are selling a stolen database containing 50 million records of Moscow driver data on an underground forum for only $800. According to Russian media outlets that purchased the database, the data appears to be valid and contains records collected between 2006 and 2019 Russian news publisher Kommersant called a small sample of the exposed individuals and ...

  • FIN7 Lures Unwitting Security Pros to Carry Out Ransomware Attacks

    October 22, 2021

    The financially motivated cybercrime gang behind the Carbanak backdoor malware, FIN7, has hit upon a genius idea for maximizing profit from ransomware: Hire real pen-testers to do some of their dirty work instead of striking partnerships with other criminals. According to a report from Gemini Advisory, the group has set up a fake security company (called ...

  • India Releases Cybersecurity Guidelines for Power Sector

    October 22, 2021

    The Indian Government’s Power Ministry and the Central Electricity Authority (CEA) recently released cybersecurity guidelines to enhance the power sector’s cybersecurity readiness. It is the first time that cybersecurity guidelines are created for the sector. CEA, under the “Central Electricity Authority (Technical Standards for Connectivity to the Grid) (Amendment) Regulations, 2019”, framed the guidelines. Moreover, all ...

  • Recycled Cobalt Strike key pairs show many crooks are using same cloned installation

    October 22, 2021

    Around 1,500 Cobalt Strike beacons uploaded to VirusTotal were reusing the same RSA keys from a cracked version of the software, according to a security researcher who pored through the malware repository. The discovery could make blue teams’ lives easier by giving them a clue about whether or not Cobalt Strike traffic across their networks is ...

  • NATO Allies take the lead on the development of NATO’s Innovation Fund

    October 22, 2021

    On Friday (22 October 2021), at a signing ceremony hosted by NATO’s Secretary General, Defence Ministers from 17 Allied countries* agreed to take the lead on the development of NATO’s first Innovation Fund. This multinational Fund will help NATO retain its technological edge by enabling investment – worth 1 billion euros – in dual-use technologies of ...

  • How your phone, laptop, or watch can be tracked by their Bluetooth transmissions

    October 22, 2021

    Over the past few years, mobile devices have become increasingly chatty over the Bluetooth Low Energy (BLE) protocol and this turns out to be a somewhat significant privacy risk. Seven boffins at University of California San Diego – Hadi Givehchian, Nishant Bhaskar, Eliana Rodriguez Herrera, Héctor Rodrigo López Soto, Christian Dameff, Dinesh Bharadia, and Aaron Schulman ...

  • TA551 Shifts Tactics to Install Sliver Red-Teaming Tool

    October 21, 2021

    The criminal threat group known as TA551 has added the Sliver red-teaming tool to its bag of tracks – a move that may signal ramped up ransomware attacks ahead, researchers said. According to Proofpoint researchers, TA551 (aka Shathak) has been mounting cyberattacks that start with email thread hijacking – an increasingly popular tactic in which adversaries ...

  • Evil Corp demands $40 million in new Macaw ransomware attacks

    October 21, 2021

    Evil Corp has launched a new ransomware called Macaw Locker to evade US sanctions that prevent victims from making ransom payments. The Evil Corp hacking group, also known Indrik Spider and the Dridex gang, has been involved in cybercrime activities since 2007, but mostly as affiliates to other organizations. Over time, the group began focusing on their ...

  • Why is Cybersecurity Failing Against Ransomware?

    October 21, 2021

    Hardly a week goes by without another major company falling victim to a ransomware attack. Nate Warfield, CTO at Prevailion, discusses the immense challenges in changing that status quo. Yes, security is hard – no one is ever 100 percent safe from the threats lurking out there. But how is it that time and time again, ...