Cybersecurity Weekly: Hackers for hire, DNS cache poisoning, The North Face attacked
APT hackers for hire target financial and entertainment firms. DNS cache poisoning attacks return due to Linux weakness. The North Face website suffered a credential stuffing attack. All this, and more, in this week’s edition of Cybersecurity Weekly.
1. APT hackers for hire target financial, entertainment firms
A hackers-for-hire operation is using a strain of previously undocumented malware to target South Asian financial institutions and global entertainment companies. Dubbed CostaRicto, the campaign appears to be the handiwork of APT mercenaries who possess bespoke malware tooling and complex VPN proxy and SSH tunneling capabilities.
2. DNS cache poisoning attacks return due to Linux weakness
Researchers from Tsinghua University and the University of California identified a new method that can be used to conduct DNS cache poisoning attacks.The new discovery revives a 2008 bug that had once been thought to have resolved for good.
3. The North Face website suffered a credential stuffing attack
Outdoor retail giant The North Face forced a password reset for a number of its customers following a successful credential stuffing attack that took place on October 8th and 9th. The threat actors were able to gain access to the accounts of several customers and related personal information. Attackers targeted accounts registered to thenorthface.com website.
4. Trojanized security software hits South Korea users in supply chain attack
Cybersecurity researchers took the wraps off a novel supply chain attack in South Korea that abuses legitimate security software and stolen digital certificates to distribute remote administration tools on target systems. The hackers leveraged the mandatory requirement that internet users in the country must install additional security software.
5. Hacker shares 3.2 million Pluto TV accounts for free on forum
Over the past week, threat actors have been releasing user databases for various commercial websites that were stolen during data breaches on a hacker forum. All of these breaches are credited to ShinyHunters, who has been responsible for numerous data breaches and the hack of Microsoft's private GitHub repository in the past.
6. New ModPipe point of sale malware targeting restaurants, hotels
Cybersecurity researchers last week disclosed a new kind of modular backdoor that targets point-of-sale restaurant management software from Oracle in an attempt to pilfer sensitive payment information stored in the devices. Exfiltrated credentials allow ModPipe's operators access to database contents.
7. Retail giant Cencosud hit by ransomware attack, stores impacted
This weekend, Cencosud was hit with a ransomware attack by the Egregor ransomware operation that encrypted devices throughout their retail outlets and impacted the company's operations. According to Argentinian publisher Clarín, retail stores are still open, but some services are impacted.
8. New Jupyter information stealer appeared in the threat landscape
Newly-discovered threat actors have been using a piece of malware, dubbed Jupyter malware, to steal information from their victims. The Jupyter malware is able to collect data from multiple applications, including major browsers and is also able to establish a backdoor on the infected system.
9. 7,500 educational organizations hacked, access being sold on hacker forums
Network access to 7,500 organizations is being sold by a threat actor on multiple hacker forums. According to the listings posted on October 3 and October 26, these mainly include educational organizations. However, the package also includes access to corporate networks from other verticals, such as entertainment and the bar industry.
10. Windows 10, iOS, Chrome, Firefox and others hacked at Tianfu Cup competition
Multiple software products from Adobe, Apple, Google, Microsoft, Mozilla and Samsung were successfully hacked with previously unseen exploits in Tianfu Cup 2020. Similar to Pwn2Own, this is the third edition of the international cybersecurity contest held in the city of Chengdu, China.
- Reduce security events
- Reinforce cyber secure behaviors
- Strengthen cybersecurity culture at your organization
In this Series
- Cybersecurity Weekly: Hackers for hire, DNS cache poisoning, The North Face attacked
- Canada Flipper Zero ban and new RustDoor macOS malware
- AnyDesk hack and iPhone patched kernel flaw
- Tesla Pwn2Own hacks and iOS push alerts abuse
- TeamViewer breach and Atlassian Jira outage
- Moscow ISP revenge hack and Microsoft Sharepoint bug warning
- X verified accounts hack and SpectralBlur macOS malware
- CISA default password alert and SOHO KV-botnet campaign
- New 5G modem flaws and Apple’s data breach report
- Staples cyberattack, Agent Racoon backdoor and other news
- British Library ransomware attack, Windows fingerprint authentication bypass
- Samsung UK data breach and ransomware actor’s SEC complaint
- ICBC ransomware attack and ChatGPT outage
- Boeing Lockbit ransomware attack, Apple’s vulnerability and WhatsApp mods spyware
- Octo Tempest hacking group and new iLeakage attack
- Okta support system breach and Google Ads fake KeePass campaign
- Skype DarkGate malware, Shadow PC breach and AvosLocker ransomware warning
- 23andMe data theft, MGM’s $100M ransomware loss and the Azure VM breach
- Malicious Bing Chat ads and FBI’s dual ransomware warning
- T-Mobile app glitch and fake Booking.com pages
- Airbus data leak, Cisco Webex ad malware and €345 million TikTok fine
- New Apple iMessage exploit and CISA’s Apache RocketMQ warning
- Forever 21 data breach and Android BadBazaar espionage
- Duolingo data leak and the Met Police IT hack
- Discord.io data breach and Ivanti Avalanche vulnerabilities
- UK Electoral Commission hack and Microsoft’s role in China email breach
- Salesforce email zero-day exploit and Microsoft Power Platform criticism
- Airlines disclose pilot data breach and the Microsoft Teams bug
- GravityRAT Android Trojan and new MOVEit Transfer flaw
- University of Manchester hack and Honda API flaws
- MOVEit zero-day exploit and the U.S. iPhone hack accusation
- Daam Android virus and Barracuda zero-day flaw
- TP-Link router exploit and 18-year-old charged with hacking DraftKings accounts
- Discord support hack and Toyota location data leak
- Twitter private tweets bug and Cisco phone router vulnerabilities
- Cisco XSS zero-day flaw and PaperCut vulnerabilities
- 3CX hackers hit critical infrastructure and secondhand routers cause security concerns
- Hyundai data breach and Microsoft’s warning to accountants
- Western Digital cloud breach and the MSI ransomware hack
- TMX loan data breach, Italy bans ChatGPT and WordPress Elementor Pro exploit
- ChatGPT data leak and Gmail message theft by North Korean hackers
- U.S. federal agency hack and the return of FakeCalls Android malware
- Massive AT&T data breach and fake jobs targeting security researchers
- U.S. Marshals service breach and TPM 2.0 security flaws
- Dangerous ChatGPT apps and food giant Dole ransomware attack
- GoDaddy malware installations, record-breaking DDoS attack and the new WhiskerSpy malware
- Reddit’s employees phished, healthcare firms targeted and the new Screenshotter malware
- JD Sports data breached, VMware ESXi servers attacked and the HeadCrab malware
- Yandex source code leaked, 4500+ WordPress sites hacked and the new SwiftSlicer malware
- PayPal accounts breached, Fortinet VPN flaw exploited, and the new Hook malware
- Twitter users’ emails leaked, ChatGPT used to write malware and Slack’s repository breach
We’ll customize our demo to your
- Security awareness goals
- Existing security and employee training tools
- Industry and compliance requirements
