Reading Time: ~ 2 min.
Thousands of Android Users fall Victim to Giveaway Fraud
Upwards of 65,000 Android users were potentially compromised after installing a malicious app promising free giveaways. Over the year the scam was in effect, roughly 5,000 apps were spoofed to lure victims into downloading in exchange for a phony giveaway. In reality, the infection pushes silent background ads which generate ad revenue for the scammers and decrease device performance.
North American Real Estate Firm Hit by Ransomware
A new ransomware variant known as DarkSide claimed its first victim, Brookfield Residential, after operating for nearly two weeks. The North American real estate developer recently noticed unauthorized access to several systems and was left a ransom note stating that over 200GB of data had been stolen. The data has since been published to DarkSide’s leak site, which has prompted many to speculate the ransom was not paid by Brookfield Residential.
Cryptominers Caught Using AI
Researchers have been at work creating an AI algorithm to detect malicious cryptocurrency miners while avoiding legitimate ones. The detection method compares currently running miners to graphs of both legitimate and illegitimate miners and monitors changes between the processes being used and the scheduling of mining activity. This type of detection may be put to use to decrease the overall use of malicious code that can often tax the system’s CPU usage to max capacity.
Los Angeles School District Suffers Cyber Attack
Just weeks after the FBI issued a warning about the threat of cyberattacks against school districts, the Rialto School District in California has fallen victim to just such an attack. These setbacks have made the return to online schooling particularly difficult. The extent of the attack remains unclear and officials are still working to determine the effects on the 25,000 enrolled students.
Maze Ransomware Cartel Adds New Variant Team
The authors of the lesser-known ransomware variant SunCrypt have recently joined forces with the Maze ransomware cartel. It’s believed the new cartel members were brought in to assist with the high volume of attacks that the Maze Group is handling and are being paid with a portion of its profits. In addition to new revenue streams from its partnership with the organization, cartel members also benefit from access to the Maze Group’s resources including obfuscation techniques and posting cartel member’s stolen data to their dedicated leak site.
The post Cyber News Rundown: Android Giveaway Fraud appeared first on Webroot Blog.
Reading Time: ~ 2 min.
Florida City Sees Lasting Effects of Ransomware Attack
Nearly three weeks after the City of Jupiter, Florida suffered a ransomware attack that took many of their internal systems offline, the city has yet to return to normal. City officials announced they would be working to rebuild their systems from backups, rather than paying any ransom, and were able to get their main website up and running again, along with many essential services. The timing of the attack couldn’t have been worse, as most of the City’s staff were under lockdown and unable to access compromised machines in a quick and safe manner.
Hackers Breach San Francisco International Airport
Late last Month, Russia-based hackers attempted to breach the internal networks of San Francisco International Airport using a simple injection script to obtain employee credentials. By forcing the use of the SMB file-sharing protocol, the hackers could quickly grab the usernames and hashed passwords, which would then allow them to deploy any number of malicious payloads or access extremely sensitive information. Shortly after the attack was detected and subsequently ended, the IT staff issued a forced password reset for all staff in hopes of minimizing any further damage.
Critical Exploits Patched by Microsoft
Recently, Microsoft patched three zero-day exploits that could allow remote code execution, privilege increases, and even creating new accounts with full OS permissions. Two of the patched flaws related to the Adobe Type Manager Library and were functional on multiple Windows® operating systems, but performed different tasks based on the environment in which they were deployed.
DDoS Suspect Arrested in Netherlands
Two Dutch government websites that were created to distribute information related to the COVID-19 pandemic fell victim to a DDoS attack for several hours. Dutch authorities, who have been heavily involved in many cybersecurity operations, have arrested at least one suspect and shut down 15 sites offering DDoS services. Hopefully, the shutdowns will help reduce the number of these types of attacks going forward.
RagnarLocker Takes Down Portuguese Energy
One of the largest energy providers in Europe, Energias de Portugal (EDP), became the victim of a ransomware attack that used the RagnarLocker variant. In exchange for the estimated 10TB of data stolen during the attack, attackers demanded a ransom of $ 10.9m to be paid in cryptocurrency. The authors behind RagnarLocker have already begun posting segments of the stolen data to their main website, along with the promise to release the rest and make their entire client list aware of the breach, if the ransom isn’t met.
The post Cyber News Rundown: Ransomware Wrecks Florida City appeared first on Webroot Blog.
Reading Time: ~ 2 min.
MedusaLocker Ransomware Spotted Worldwide
While it’s still unclear how MedusaLocker is spreading, the victims have been confirmed around the world in just the last month. By starting with a preparation phase, this variant can ensure that local networking functionality is active and maintain access to network drives. After shutting down security software and deleting Shadow Volume copies, it begins encrypting files while setting up self-preservation tasks.
Bargain Website Server Exposes Customer Data
Several websites used by UK customers to find bargains have left a database filled with customer data belonging to nearly 3.5 million users completely unprotected and connected to the internet. Along with the names and addresses of customers, the database also included banking details and other sensitive information that could be used to commit identity fraud. The researchers who initially discovered the breach notified the site owners, but received no response or any indication the leak would be resolved until nearly six weeks after the database was left exposed.
Arrests Made Following Major BEC Scam
At least three individuals have been arrested in Spain for their connection to a business email compromise (BEC) scam that netted over 10 million euros and affected 12 companies across 10 countries. It appears the operation began in 2016 and involved the cooperation of multiple law enforcement agencies. By creating a web of fake companies and bank accounts, the group was able to successfully launder money into various investments, including real estate, in an attempt to remain undetected.
LA Court System Hacked
The perpetrator of a 2017 spear phishing attack on the LA court system was sentenced to 145 months in prison following convictions on charges of wire fraud, unauthorized access to a computer, and identity theft. The individual was able to compromise employee email accounts and use them to launch a malspam campaign that distributed over 2 million emails.
Pennsylvania School District Hacked
Multiple students are being questioned after school district officials noticed unauthorized access to the student assistance site Naviance, a hack which appears to have been an attempt “to gain a competitive edge in a high-stakes water gun fight.” Access to the site would have also given them access to other student’s personal data, though no financial or social security information is stored on the site. District officials determined the security practices for the site lacking but have not currently released plans for improvement.
The post Cyber News Rundown: MedusaLocker Ransomware appeared first on Webroot Blog.
Reading Time: ~ 2 min.
Bed, Bath, & Beyond Data Breach
An official announcement made earlier this week acknowledged illicit access to customer data used in online accounts for Bed, Bath, & Beyond. While the breach didn’t affect payment card information, the retailer quickly began contacting affected customers and took steps to safeguard against future incidents.
Johannesburg Shutdown After Cyber Attack
Three months after a cyber attack hit Johannesburg, South Africa, the city is once again dealing with network outages. After a ransom note was posted to several social media outlets, city officials are still attempting to downplay the attacks by claiming they purposefully took down the sites rather than them being ransomed by hackers. In addition to the ransom note, hackers also posted screenshots proving their control over the city’s network systems and their expectation of payment.
UniCredit Financial Data Leak
Officials working for UniCredit, an Italian banking firm, announced that unauthorized access to their systems has left the sensitive information of nearly 3 million Italian exposed. Fortunately, the stolen information did not include any financial data, but did contain personally identifiable information such as names and contact details. It is unclear how hackers gained access to the data, though it appears the data may have even been taken years earlier in prior security breaches faced by the firm.
Ransomware Shuts Down New Mexico School District
Las Cruces Public Schools, a New Mexico school district, was forced to take their entire system offline following a ransomware attack. While email and other important services are still offline, students have still been attending classes as normal, though the process of fully remediating the incident has just begun. It is still unclear how the attack was initiated, but it’s the latest in a long line of educational institutions that have fallen victim to ransomware this year.
Malware Attack on Indian Power Plant
It has been confirmed that both an Indian nuclear power plant and another piece of infrastructure have fallen victim to a malware attack apparently tied to North Korean actors. Fortunately, the attacks did not allow unauthorized control of the systems, though this attack may have been only a test to determine security and response times in preparation for a larger, future attack.
The post Cyber News Rundown: Bed, Bath, & Beyond Data Breach appeared first on Webroot Blog.
Reading Time: ~ 2 min.
BEC Scam Takes Millions from Nikkei America
Officials for Nikkei are working to identify the perpetrators of a recent business email compromise (BEC) scam that took roughly $ 29 million from the company’s American subsidiary. The illicit transfer took place sometime during the end of September and, though they did make a public statement last week, the only clues they have are the Hong Kong bank account that the funds were sent to. While this is not the largest scam of this type to occur this year, it does serve to underscore the prevalence and continued success of these attacks.
Canadian Province Shuts Down After Ransomware Attack
Government networks for the Nunavut territory of Canada have been taken offline following a ransomware attack that appears to have been executed by an unwitting employee. Fortunately, even thought their security systems failed to block the infection, the affected offices keep regular backups to safeguard against this type of issue. However, even with these failsafe measures, it may still take about a week to get all of the official systems back to full operation.
Facebook API Allows Unauthorized Access to User Accounts
Several developer apps have been found retaining user info and photos from Groups for much longer than previously anticipated by Facebook. This is, by no means, the first time in recent years that Facebook has fallen under scrutiny; it comes nearly a year after the Cambridge Analytica findings, not to mention the more recent news about the company removing thousands of apps that had been misusing customer data. While the social media giant has made a number of changes to stop these types of data leaks, they clearly still have a lot more work to do to ensure their clients’ data is safe.
Indian Education Firm Data Leak
A database belonging to an Indian tech firm may have exposed sensitive information for over 600,000 customers. Even more alarming than the high number of victims is that this leak seems to have begun back in July of this year, begging the question as to why it took so long for the firm to make an official announcement. Due to the sheer volume of exposed data, the company has already started contacting affected customers in hopes of preventing any further misuse of their information.
MegaCortex Ransomware Demos New Tactics
The latest variant of MegaCortex has brought with it a plethora of new features and functionality. While it does still perform RSA encryption on nearly every file on the machine, it now also has the ability to change the main system password, making it very difficult for the victim to access their own system at all. In addition to the typical ransom note that demands quick crypto-based payment, this variant also threatens victims in lurid detail as to how their encrypted files will be published to the masses.
The post Cyber News Rundown: Nikkei BEC Scam appeared first on Webroot Blog.