Daily NCSC-FI news followup 2020-04-17

China-linked Electric Panda hackers seek U.S. targets, intel agency warns

www.politico.com/news/2020/04/16/china-electric-panda-hackers-seek-us-targets-191220 Nearly 40 U.S. contracting facilities with access to classified information have been targeted by a hacking group with suspected ties to the Chinese government since Feb. 1, according to a bulletin disseminated to contractors by the Defense Counterintelligence and Security Agency on Wednesday.

Hacking against corporations surges as workers take computers home

www.reuters.com/article/us-health-coronavirus-cyber-corporations/hacking-against-corporations-surges-as-workers-take-computers-home-idUSKBN21Z0Y6 Also

arcticsecurity.com/news/2020/04/17/number-of-potentially-compromised-organizations-more-than-doubles-since-january/

Does Covid-19 Contact Tracing Pose a Privacy Risk? Your Questions, Answered

www.wired.com/story/apple-google-contact-tracing-strengths-weaknesses/ Apple and Google’s Bluetooth-based system isn’t perfect. But many of the biggest concerns have solutions.

NHS in standoff with Apple and Google over coronavirus tracing

www.theguardian.com/technology/2020/apr/16/nhs-in-standoff-with-apple-and-google-over-coronavirus-tracing Tech firms place limitations on how tracing apps may work in effort to protect users’ privacy

Europe publishes draft rules for coronavirus contact-tracing app development, on a relaxed schedule

www.theregister.co.uk/2020/04/17/european_contact_tracing_app_spec/ No phone numbers needed but you’ll need Notifications and Bluetooth on all the time

Coronavirus scams: This is how much people have lost to online fraudsters so far

www.zdnet.com/article/coronavirus-scams-this-is-how-much-people-have-lost-to-online-fraudsters-so-far/ Over £2 million has been lost to coronavirus themed scams, phishing emails and other fraud in the UK alone as cyber criminals look to exploit the COVID-19 pandemic for their own gain.

Google to Gmail users: Coronavirus phishing is targeting you. This is how we hit back

www.zdnet.com/article/google-to-gmail-users-coronavirus-phishing-is-targeting-you-this-is-how-we-hit-back/ The company says it blocked 18 million COVID-19 themed phishing emails last week. The blocked COVID-19 phishing emails targeting Gmail users would represent about 2.5% of the 100 million phishing emails Google said in 2019 it blocks daily. Google is also blocking 240 million COVID-related daily spam messages each day.

India says ‘Zoom is a not a safe platform’ and bans government users

www.theregister.co.uk/2020/04/17/india_government_zoom_ban/

Half a million Zoom accounts for sale on the dark web

www.welivesecurity.com/2020/04/16/half-million-zoom-accounts-sale-dark-web/ Even accounts belonging to banks and educational institutions were found on lists plastered across various hacker forums

Leading accounting firm MNP hit with cyberattack

www.bleepingcomputer.com/news/security/leading-accounting-firm-mnp-hit-with-cyberattack/ A leading accounting firm in Canada forced a company-wide shutdown of their systems after getting hit with a cyberattack last weekend, BleepingComputer has learned.

Threat Roundup for April 10 to April 17

blog.talosintelligence.com/2020/04/threat-roundup-0410-0417.html Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between April 10 and April 17. As with previous roundups, this post isn’t meant to be an in-depth analysis.

Clipboard hijacking malware found in 725 Ruby libraries

www.zdnet.com/article/clipboard-hijacking-malware-found-in-725-ruby-libraries/ The malware would replace Bitcoin addresses copied to the clipboard with one controlled by the attacker.

PoetRAT Trojan targets energy sector using coronavirus lures

www.zdnet.com/article/poetrat-trojan-targets-energy-sector-using-coronavirus-lures/ Wind turbine operators are the focus of a new data-stealing campaign.

Hackers Update Age-Old Excel 4.0 Macro Attack

threatpost.com/hackers-update-age-old-excel-4-0-macro-attack/154898/ XLS files sent via emails appear password protected but aren’t, opening automatically to install malware from compromised macros, according to researchers.

Weaponized RTF Document Generator & Mailer in PowerShell

isc.sans.edu/diary/rss/26030 Like many malicious activities that occur in those days, it is related to the COVID19 pandemic. Its purpose of simple: It checks if Outlook is used by the victim and, if it’s the case, it generates a malicious RTF document that is spread to all contacts extracted from Outlook. Let’s have a look at it.

A Brand New Ursnif/ISFB Campaign Targets Italian Organizations

yoroi.company/research/a-brand-new-ursnif-isfb-campaign-targets-italian-organizations/ Ursnif is one of the most and widespread threats, it is delivered through malspam campaigns aimed at multiple industries across Italy and Europe.

You’re a botnet, you’ve got a zero-day, so where do you go? After fiber, because that’s where the bandwidth is

www.theregister.co.uk/2020/04/16/fiber_routers_under_fire/ Two-step attack seen on core systems. Researchers are warning owners of fiber routers to keep a close eye on their gear and check for firmware updates following the discovery an in-the-wild zero-day attack.

That critical VMware vuln allowed anyone on your network to create new admin users, no creds needed

www.theregister.co.uk/2020/04/17/vmware_vcenter_critical_vuln_anyone_create_admin_users/

Critical ‘starbleed’ vulnerability in FPGA chips identified

www.eurekalert.org/pub_releases/2020-04/rb-cv041620.php FPGA chips are part of many safety-critical applications; they have one particular valuable feature: they are individually reprogrammable – — but with this feature also comes a risk

ICANN delays.org sell off after California’s attorney general intervenes at last minute, tears non-profit a new one over sale

www.theregister.co.uk/2020/04/17/icann_california_org_sale_delay/

Using AppLocker to Prevent Living off the Land Attacks

isc.sans.edu/diary/rss/26032

You Can Now Check If Your ISP Uses Basic Security Measures

www.wired.com/story/cloudflare-bgp-routing-safe-yet/ “Is BGP Safe Yet” is a new site that names and shames internet service providers that don’t tend to their routing.

You might be interested in …

Daily NCSC-FI news followup 2019-09-26

Magecart Group Targets Routers Behind Public Wi-Fi Networks threatpost.com/magecart-group-targets-routers-behind-public-wi-fi-networks/148662/ Magecart Group 5 has been spotted testing and preparing code to be injected onto commercial routers potentially opening up guests connecting to Wi-Fi networks to payment data theft.. Read also: www.zdnet.com/article/hackers-looking-into-injecting-card-stealing-code-on-routers-rather-than-websites/ and Microsoft Phishing Attack Uses Google Redirects to Evade Detection www.bleepingcomputer.com/news/security/microsoft-phishing-attack-uses-google-redirects-to-evade-detection/ A new phishing campaign […]

Read More

Daily NCSC-FI news followup 2020-03-20

GUIDANCE ON THE ESSENTIAL CRITICAL INFRASTRUCTURE WORKFORCE www.cisa.gov/publication/guidance-essential-critical-infrastructure-workforce MEMORANDUM ON IDENTIFICATION OF ESSENTIAL CRITICAL INFRASTRUCTURE WORKERS DURING COVID-19 RESPONSE Sodinokibi Ransomware Data Leaks Now Sold on Hacker Forums www.bleepingcomputer.com/news/security/sodinokibi-ransomware-data-leaks-now-sold-on-hacker-forums/ Ransomware victims who do not pay a ransom and have their stolen files leaked are now facing a bigger nightmare as other hackers and criminals sell […]

Read More

Daily NCSC-FI news followup 2019-08-20

Guccifer Rising? Months-Long Phishing Campaign on ProtonMail Targets Dozens of Russia-Focused Journalists and NGOs www.bellingcat.com/news/uk-and-europe/2019/08/10/guccifer-rising-months-long-phishing-campaign-on-protonmail-targets-dozens-of-russia-focused-journalists-and-ngos/ A sophisticated phishing campaign targeting Bellingcat and other Russia-focused journalists has been much larger in scope than previously thought, and has lasted at least several months. Bellingcat has identified dozens of targeted individuals across Europe and the US, with the […]

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.