As well reported, UK foreign exchange firm Travelex business operations were brought to a standstill after its IT systems were severely hit by the Sodinokibi ransomware at the start of the year. It was reported that REvil group were behind the attack and had stolen 5Gbs of customer personal data, and then demanded $6 million (£4.6m) in ransom. The Wall Street Journal reported in April 2020 that Travelex had reached a deal, paying $2.3 million (£1.84m) in Bitcoin to the cybercriminals. This sort of response incentivises future ransomware activity against all other businesses and could lead to an inflation of future cyber-extortion demands in my opinion.
Cognizant, a US large digital solutions provider and IT consultancy, was reportedly hit by the Maze ransomware. Maze, previously known as the 'ChaCha' ransomware, like the Travelex attack, not only encrypts victim's files but steals sensitive data from the IT systems as well. Enabling the bad guys to threaten the publishing of the stolen data if the organisation cough up to their cyber-extortion demands, so the bad guys are very much rinsing and repeating lucrative attacks.
Microsoft wrote an excellent blog covering the 'motley crew' of ransomware payloads The blog covers ransomware payloads said to be straining security operations especially in health care, Microsoft warned, urging security teams to look for signs of credential theft and lateral movement activities that herald attacks.
Researchers continue to be busy in exposing large sensitive datasets within misconfigured cloud services. In April researchers reported 14 million Ring user details exposed in misconfigured AWS open database, fitness software Kinomap had 42 million user details exposed in another misconfigured database, and Maropost had 95 million users exposed, also in a misconfigured database.
Nintendo confirmed 160,000 of its users' accounts had been accessed, exposing PII and Nintendo store accounts. The gaming giant Nintendo said from April, its user's accounts were accessed through the Nintendo Network ID (NNID), which is primarily used for Switch gaming. The company is unaware exactly how the intrusion had occurred, saying it “seems to have been made by impersonating login to “Nintendo Network ID. “If you use the same password for your NNID and Nintendo account, your balance and registered credit card / PayPal may be illegally used at My Nintendo Store or Nintendo eShop. Please set different passwords for NNID and Nintendo account,” Nintendo said. In response to these issues the company has abolished user’s ability to log into their Nintendo account via NNID and passwords for both NNID and Nintendo accounts are being reset and the company is recommending multi-factor authentication be set up for each account. The account breaches weren't the only cyber issue affecting Nintendo in April, it reported that a bot, dubbed 'Bird Bot' was used by a reseller to buy up Nintendo Switches before customers could make their Switch purchase from Nintendo. The bot using reseller benefits at the expense of consumers, in buying up all available Switches directly from Nintendo, they are able to sell them on for higher prices, so making a quick and easy tidy profit, due to the current high demand of Switches and lack of supply.
April was a busy month for security updates, Microsoft released security patches fixing 113 vulnerabilities on Patch Tuesday and an out-of-band patch for Teams found by researchers at CyberArk. Patch Tuesday for a quiet one for Adobe, though they released fixes for 21 critical vulnerabilities in illustrator and Bridge at the end of the month. Oracle released a huge 397 fixes for 450 CVEs in over 100 products, which I think is a new record for a patch release!
Sophos said it and its customers were attacked when a previously unknown SQL injection vulnerability in their physical and virtual XG Firewall units was exploited. “The attack affected systems configured with either the administration interface (HTTPS admin service) or the user portal exposed on the WAN zone. In addition, firewalls manually configured to expose a firewall service (e.g. SSL VPN) to the WAN zone that shares the same port as the admin or User Portal were also affected,” Sophos said.
There were security critical patch releases for Mozilla Firefox, Chrome (twice), and for 8 Cisco products. A bunch of VMware patches for including a CVSS scored 10 (highest possible) in vCenter, a critical in vRealize Log Insight and a critical cross-site scripting vulnerability in ESXi 6.5 and 6.7. And finally, on the patch front, Intel decided to discontinue multiple products, as it was unable to keep ahead of patch their vulnerabilities.
BLOG
- How Safe are Video Messaging Apps?
- Security Threats Facing Modern Mobile Apps
- How to Keep Your Video Conferencing Meetings Secure
- YesWeHack Cybersecurity Training Temporarily Free for Schools and Universities
- Cyber Security Roundup for April 2020
- Travelex Paid $2.3 Million in Ransom to REvil Cyber Gang
- IT Services Firm Cognizant falls Victim to Maze Ransomware
- Nintendo Confirms 160,000 User Accounts Hacked
- Bug Brokers put Two Zoom Zero-Days on the Market
- 14 Million Key Ring Users Exposed in Misconfigured AWS Open Database
- Maropost Misconfigured Database with 95 Million left Open and Unsecure
- Fitness Software maker Kinomap leaves Database Open Exposing 42 Million Users
- BT Delays Removal of Huawei from EE's core Network by Two Years
- Huawei Warns cutting its 5G role would be 'disserve' to Britain
AWARENESS, EDUCATION AND THREAT INTELLIGENCE
- Microsoft warns of Ransomware Attacks with ‘motley crew’ of Payloads
- Brute Forcing RDP Credentials on the Rise
- Emotet Banking Trojan possibly being Prepped for a New Attack
- Phishing Campaign aims to steal Zoom Credentials using Fake Layoff Notifications
- Interpol warns Hospitals about COVID-19-based Ransomware Threat
- Google Blocking 18 Million Coronavirus Scam Emails Every Day
No comments:
Post a Comment