Daily NCSC-FI news followup 2020-11-01

Nyt tuli peli, jota puolustusministeriökin hehkuttaa: “Nyt saa pelata työajalla”

www.is.fi/digitoday/tietoturva/art-2000006705549.html Digiturvallinen elämä -peli ei vie paljoa aikaa, mutta sen hyödyt voivat kantaa pitkälle.

US Cyber Command exposes new Russian malware

www.zdnet.com/article/us-cyber-command-exposes-new-russian-malware/#ftag=RSSbaffb68 Together with CISA and the FBI, US Cyber Command wish Russian state hackers a “Happy Halloween!”. Six of the eight samples are for the ComRAT malware (used by the Turla hacking group), while the other two are samples for the Zebrocy malware (used by the APT28 hacking group).

A new scam uses Google Drive to send out a deluge of dodgy links

www.wired.co.uk/article/google-drive-spam-comments-phishing Scammers are luring people into Google Drive documents in an attempt to get them to visit potentially malicious websites. Scammers just found a new phishing lure to play with: Google Drive. A flaw in the Drive is being exploited to send out seemingly legitimate emails and push notifications from Google that, if opened, could land people on malicious websites. The scam itself is nothing new messages asking you to click on dodgy links are as old as the internet itself but could catch a lot of people off guard. The smartest part of the scam is that the emails and notifications it generates come directly from Google. On mobile, the scam uses the collaboration feature in Google Drive to generate a push notification inviting people to collaborate on a document. If tapped, the notification takes you directly to a document that contains a very large, tempting link. An email notification created by the scam, which also comes from Google, also contains a potentially malicious link. Unlike regular spam, which Gmail does a pretty good job of filtering out, this message not only makes it into your inbox, it gets an added layer of legitimacy by coming from Google itself.

Ransom Hackers In Finland Are Using Psychotherapy Medical Records As Ammunition

www.forbes.com/sites/michalgromek/2020/10/31/ransom-hackers-in-finland-are-using-psychotherapy-medical-records-as-ammunition/ Multiple potentially unrelated individuals have gained access to Vastaamo’ psychotherapy centres which treated up to 50.000 patients primarily in Oulu and Tampere. The hackers exploited a security breach of 2018 and early 2019 which seems to not have been extensively reported to authorities or the general public.

Ex-tietosuojavaltuutettu Reijo Aarnio jyrähtää vielä kerran: Vastaamon tietomurto on digitaalista väkivaltaa ja verinen vääryys

yle.fi/uutiset/3-11615577 Aarnion yli kahdenkymmenen vuoden ura päättyi kauhuesimerkkiin siitä mitä tapahtuu, kun yritys ei huolehdi tietoturvastaan.

Naked Zoom Users Targeted By New Cybercrime Campaign

www.forbes.com/sites/daveywinder/2020/11/01/naked-zoom-users-targeted-by-new-cybercrime-campaign/ An ongoing cybercrime campaign targets Zoom users who may have got naked or intimate on camera.

Gold seller JM Bullion hacked to steal customers’ credit cards

www.bleepingcomputer.com/news/security/gold-seller-jm-bullion-hacked-to-steal-customers-credit-cards/ Precious metal online retailer JM Bullion has disclosed a data breach after their site was hacked to include malicious scripts that stole customers’ credit card information.

You might be interested in …

Daily NCSC-FI news followup 2019-10-22

Googlen ja Amazonin älykaiuttimia voi käyttää vakoiluun ja tietojen urkintaan haittasovelluksien kautta. www.is.fi/digitoday/art-2000006281649.html Tutkijat esittelevät julkaisemallaan videolla yhtä mahdollista urkintakeinoa. Horoskooppisovellukseksi naamioitu haittasovellus ilmoittaa ensin, ettei horoskoopin luku onnistu ja hiljenee. Sammumisen sijaan sovellus pysyy kuitenkin käynnissä. 3 Key Questions to Help Address Enterprise IoT Security Risks securityintelligence.com/posts/3-key-questions-to-help-address-enterprise-iot-security-risks/ Armis estimated that by 2021, up to […]

Read More

Daily NCSC-FI news followup 2021-04-22

CISA Identifies SUPERNOVA Malware During Incident Response us-cert.cisa.gov/ncas/analysis-reports/ar21-112a SUPERNOVA is a malicious webshell backdoor that allows a remote operator to dynamically inject C# source code into a web portal to subsequently inject code. APT actors use SUPERNOVA to perform reconnaissance, conduct domain mapping, and steal sensitive information and credentials. SolarWinds hack analysis reveals 56% boost […]

Read More

Daily NCSC-FI news followup 2020-09-08

Microsoft September 2020 Patch Tuesday fixes 129 vulnerabilities www.zdnet.com/article/microsoft-september-2020-patch-tuesday-fixes-129-vulnerabilities/ Twenty critical remote code execution bugs have been patched this month, including in Windows and SharePoint enterprise servers. See also: isc.sans.edu/diary/rss/26544 Critical Adobe Flaws Allow Attackers to Run JavaScript in Browsers threatpost.com/critical-adobe-flaws-attackers-javascript-browsers/159026/ Adobe patched 11 bugs overall in its Experience Manager; five of those are rated […]

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.