Daily NCSC-FI news followup 2020-07-24

Garmin outage caused by confirmed WastedLocker ransomware attack

www.bleepingcomputer.com/news/security/garmin-outage-caused-by-confirmed-wastedlocker-ransomware-attack/ Wearable device maker Garmin shut down some of its connected services and call centers on Thursday following what the company called a worldwide outage, now confirmed to be caused by a WastedLocker ransomware attack. Lisäksi

www.zdnet.com/article/garmin-services-and-production-go-down-after-ransomware-attack/ ja

www.forbes.com/sites/leemathews/2020/07/23/garmins-alleged-ransomware-wastedlocker-evil-corp/ ja thehackernews.com/2020/07/garmin-ransomware-attack.html ja


Poliisi varoittaa Microsoft huijaussoitoista – älä anna pankkitietoja tai henkilötietoja puhelimessa

www.poliisi.fi/tietoa_poliisista/tiedotteet/1/1/poliisi_varoittaa_microsoft_huijaussoitoista_-_ala_anna_pankkitietoja_tai_henkilotietoja_puhelimessa_91999?language=fi Poliisi muistuttaa, että pankkitunnustietoja tai henkilötietoja ei pidä koskaan luovuttaa, jos ei ole varma vastaanottajasta. Viranomaiset, rahalaitokset tai muut asialliset tahot eivät koskaan kysy tällaisia tietoja puhelimitse. Lisäksi

www.poliisi.fi/tietoa_poliisista/tiedotteet/1/1/poliisi_muistuttaa_edelleen_-_ala_anna_pankkitunnuksiasi_kenellekaan_92000?language=fi – – Poliisi muistuttaa edelleen : Älä anna pankkitunnuksiasi kenellekään

Spanish state-owned railway infrastructure manager ADIF infected with ransomware

securityaffairs.co/wordpress/106304/cyber-crime/adif-revil-ransomware-attack.html ADIF, a Spanish state-owned railway infrastructure manager under the responsibility of the Ministry of Development, was hit by REVil ransomware operators

Twitter hackers read private messages of 36 high-profile accounts

www.bleepingcomputer.com/news/security/twitter-hackers-read-private-messages-of-36-high-profile-accounts/ Twitter today admitted that the attackers behind last week’s incident read the private messages of 36 out of a total of 130 high-profile accounts targeted in the attack. Lisäksi

www.theregister.com/2020/07/23/twitter_hack_dutch_politician_dms_accessed/ ja


ASUS Home Router Bugs Open Consumers to Snooping Attacks

threatpost.com/asus-home-router-bugs-snooping-attacks/157682/ The two flaws allow man-in-the-middle attacks that would give an attacker access to all data flowing through the router. Lisäksi


Yhdysvaltain ja Kiinan kylmä sota jatkuu kahta kiinalaishakkeria syytetään yritysvakoilusta

www.kauppalehti.fi/uutiset/yhdysvaltain-ja-kiinan-kylma-sota-jatkuu-kahta-kiinalaishakkeria-syytetaan-yritysvakoilusta/dbbfd712-71de-478b-9943-f8ebebd26997 Yhdysvallat on julkaissut tietoja syytteestä kahta kiinalaishakkeria kohtaan. Syytteen mukaan hakkerit onnistuivat kymmenen vuoden aikana kaappaamaan valtavan määrän salaista dataa amerikkalaisyrityksistä. Lisäksi


New variant of Phobos ransomware is coming

blog.360totalsecurity.com/en/new-variant-of-phobos-ransomware-is-coming/ Recently, 360 Security Center has detected that a new variant of the Phobos ransomware virus appeared on the network. The virus uses software such as system activation tools as a carrier to induce users to download and install, steal the user’s machine information, and further pass the Trojan C&C server Download encryption ransomware related programs and implement Bitcoin ransomware.

A vigilante is sabotaging the Emotet botnet by replacing malware payloads with GIFs

www.zdnet.com/article/a-vigilante-is-sabotaging-the-emotet-botnet-by-replacing-malware-payloads-with-gifs/ An unknown vigilante hacker has been sabotaging the operations of the recently-revived Emotet botnet by replacing Emotet payloads with animated GIFs, effectively preventing victims from getting infected.

Alert (AA20-206A) Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902

us-cert.cisa.gov/ncas/alerts/aa20-206a CISA is issuing this alert in response to recently disclosed exploits that target F5 BIG-IP devices that are vulnerable to CVE-2020-5902. F5 Networks, Inc. released a patch for CVE-2020-5902 on June 30, 2020. Unpatched F5 BIG-IP devices are an attractive target for malicious actors. Affected organizations that have not applied the patch to fix this critical remote code execution (RCE) vulnerability risk an attacker exploiting CVE-2020-5902 to take control of their system. Note: F5’s security advisory for CVE-2020-5902 states that there is a high probability that any remaining unpatched devices are likely already compromised.

You might be interested in …

Daily NCSC-FI news followup 2019-11-03

BlueKeep attacks are happening, but it’s not a worm www.zdnet.com/article/bluekeep-attacks-are-happening-but-its-not-a-worm/ Hackers are using BlueKeep to break into Windows systems and install a cryptocurrency miner. Security researchers have spotted the first mass-hacking campaign using the BlueKeep exploit; however, the exploit is not being used as a self-spreading worm, as Microsoft was afraid it would happen last […]

Read More

Daily NCSC-FI news followup 2019-07-13

Brazil is at the forefront of a new type of router attack www.zdnet.com/article/brazil-is-at-the-forefront-of-a-new-type-of-router-attack/ On these sites, malicious ads (malvertising) run special code inside users’ browsers to search and detect the IP address of a home router, the router’s model. When they detect the router’s IP and model, the malicious ads then use a list of […]

Read More

Daily NCSC-FI news followup 2020-06-22

Google Analytics as a data exfiltration channel www.kaspersky.com/blog/web-skimming-with-ga/35986/ Web skimming, a fairly common method of getting cardholder data from visitors of online stores, is a time-honored cybercriminal practice. Recently, however, our experts discovered a rather dangerous innovation involving the use of Google Analytics to exfiltrate stolen data. Lets explore why this is dangerous and how […]

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.