Daily NCSC-FI news followup 2020-04-17

China-linked Electric Panda hackers seek U.S. targets, intel agency warns

www.politico.com/news/2020/04/16/china-electric-panda-hackers-seek-us-targets-191220 Nearly 40 U.S. contracting facilities with access to classified information have been targeted by a hacking group with suspected ties to the Chinese government since Feb. 1, according to a bulletin disseminated to contractors by the Defense Counterintelligence and Security Agency on Wednesday.

Hacking against corporations surges as workers take computers home

www.reuters.com/article/us-health-coronavirus-cyber-corporations/hacking-against-corporations-surges-as-workers-take-computers-home-idUSKBN21Z0Y6 Also


Does Covid-19 Contact Tracing Pose a Privacy Risk? Your Questions, Answered

www.wired.com/story/apple-google-contact-tracing-strengths-weaknesses/ Apple and Google’s Bluetooth-based system isn’t perfect. But many of the biggest concerns have solutions.

NHS in standoff with Apple and Google over coronavirus tracing

www.theguardian.com/technology/2020/apr/16/nhs-in-standoff-with-apple-and-google-over-coronavirus-tracing Tech firms place limitations on how tracing apps may work in effort to protect users’ privacy

Europe publishes draft rules for coronavirus contact-tracing app development, on a relaxed schedule

www.theregister.co.uk/2020/04/17/european_contact_tracing_app_spec/ No phone numbers needed but you’ll need Notifications and Bluetooth on all the time

Coronavirus scams: This is how much people have lost to online fraudsters so far

www.zdnet.com/article/coronavirus-scams-this-is-how-much-people-have-lost-to-online-fraudsters-so-far/ Over £2 million has been lost to coronavirus themed scams, phishing emails and other fraud in the UK alone as cyber criminals look to exploit the COVID-19 pandemic for their own gain.

Google to Gmail users: Coronavirus phishing is targeting you. This is how we hit back

www.zdnet.com/article/google-to-gmail-users-coronavirus-phishing-is-targeting-you-this-is-how-we-hit-back/ The company says it blocked 18 million COVID-19 themed phishing emails last week. The blocked COVID-19 phishing emails targeting Gmail users would represent about 2.5% of the 100 million phishing emails Google said in 2019 it blocks daily. Google is also blocking 240 million COVID-related daily spam messages each day.

India says ‘Zoom is a not a safe platform’ and bans government users


Half a million Zoom accounts for sale on the dark web

www.welivesecurity.com/2020/04/16/half-million-zoom-accounts-sale-dark-web/ Even accounts belonging to banks and educational institutions were found on lists plastered across various hacker forums

Leading accounting firm MNP hit with cyberattack

www.bleepingcomputer.com/news/security/leading-accounting-firm-mnp-hit-with-cyberattack/ A leading accounting firm in Canada forced a company-wide shutdown of their systems after getting hit with a cyberattack last weekend, BleepingComputer has learned.

Threat Roundup for April 10 to April 17

blog.talosintelligence.com/2020/04/threat-roundup-0410-0417.html Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between April 10 and April 17. As with previous roundups, this post isn’t meant to be an in-depth analysis.

Clipboard hijacking malware found in 725 Ruby libraries

www.zdnet.com/article/clipboard-hijacking-malware-found-in-725-ruby-libraries/ The malware would replace Bitcoin addresses copied to the clipboard with one controlled by the attacker.

PoetRAT Trojan targets energy sector using coronavirus lures

www.zdnet.com/article/poetrat-trojan-targets-energy-sector-using-coronavirus-lures/ Wind turbine operators are the focus of a new data-stealing campaign.

Hackers Update Age-Old Excel 4.0 Macro Attack

threatpost.com/hackers-update-age-old-excel-4-0-macro-attack/154898/ XLS files sent via emails appear password protected but aren’t, opening automatically to install malware from compromised macros, according to researchers.

Weaponized RTF Document Generator & Mailer in PowerShell

isc.sans.edu/diary/rss/26030 Like many malicious activities that occur in those days, it is related to the COVID19 pandemic. Its purpose of simple: It checks if Outlook is used by the victim and, if it’s the case, it generates a malicious RTF document that is spread to all contacts extracted from Outlook. Let’s have a look at it.

A Brand New Ursnif/ISFB Campaign Targets Italian Organizations

yoroi.company/research/a-brand-new-ursnif-isfb-campaign-targets-italian-organizations/ Ursnif is one of the most and widespread threats, it is delivered through malspam campaigns aimed at multiple industries across Italy and Europe.

You’re a botnet, you’ve got a zero-day, so where do you go? After fiber, because that’s where the bandwidth is

www.theregister.co.uk/2020/04/16/fiber_routers_under_fire/ Two-step attack seen on core systems. Researchers are warning owners of fiber routers to keep a close eye on their gear and check for firmware updates following the discovery an in-the-wild zero-day attack.

That critical VMware vuln allowed anyone on your network to create new admin users, no creds needed


Critical ‘starbleed’ vulnerability in FPGA chips identified

www.eurekalert.org/pub_releases/2020-04/rb-cv041620.php FPGA chips are part of many safety-critical applications; they have one particular valuable feature: they are individually reprogrammable – — but with this feature also comes a risk

ICANN delays.org sell off after California’s attorney general intervenes at last minute, tears non-profit a new one over sale


Using AppLocker to Prevent Living off the Land Attacks


You Can Now Check If Your ISP Uses Basic Security Measures

www.wired.com/story/cloudflare-bgp-routing-safe-yet/ “Is BGP Safe Yet” is a new site that names and shames internet service providers that don’t tend to their routing.

You might be interested in …

Daily NCSC-FI news followup 2020-06-23

Introducing the TypeRefHash (TRH) www.gdatasoftware.com/blog/2020/06/36164-introducing-the-typerefhash-trh We introduce the TypeRefHash (TRH) which is an alternative to the ImpHash that does not work with .NET binaries. Our evaluation shows that it can effectively be used to identify .NET malware families. Zoom 5 moves toward security www.kaspersky.com/blog/zoom-5-security/36001/ Zoom developers have made their service more secure. We review whats […]

Read More

Daily NCSC-FI news followup 2020-04-03

A hacker has wiped, defaced more than 15,000 Elasticsearch servers www.zdnet.com/article/a-hacker-has-wiped-defaced-more-than-15000-elasticsearch-servers/ For the past two weeks, a hacker has been breaking into Elasticsearch servers that have been left open on the internet without a password and attempting to wipe their content, while also leaving the name of a cyber-security firm behind, trying to divert blame. […]

Read More

Daily NCSC-FI news followup 2021-10-22

Ransomware: Looking for weaknesses in your own network is key to stopping attacks www.zdnet.com/article/ransomware-looking-for-weaknesses-in-your-own-network-is-key-to-stopping-attacks/ Ransomware is a major cybersecurity threat to organisations around the world, but it’s possible to reduce the impact of an attack if you have a thorough understanding of your own network and the correct protections are in place. While the best […]

Read More

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.