Cybersecurity Weekly: REvil decryptor, AT&T loses millions, OMIGOD flaw
A free decryptor for past REvil ransomware victims was released. AT&T lost $200 million to an illegal phone unlocking scheme. Mirai Botnet started exploiting the OMIGOD flaw. All this, and more, in this week’s edition of Cybersecurity Weekly.
1. Free decryptor for past REvil ransomware victims released
The experts at security firm Bitdefender have made available a universal decryptor for victims of the REvil ransomware. REvil appeared to go offline in mid-July, but its infrastructure has come back online in recent days – raising concerns that it may be about to launch new attacks.
2. AT&T lost $200 million to illegal phone unlocking scheme
AT&T found that 1,900,033 cellular phones were illegally unlocked by conspirators behind this scheme, resulting in $200 million in losses due to lost payments. The company also sued former employees fired after discovering they were bribed into illegally unlocking phones and planting malware and malicious tools on its network.
3. Mirai Botnet started exploiting OMIGOD flaw
Recently released security updates have addressed four severe vulnerabilities, collectively tracked as OMIGOD, in the Open Management Infrastructure software agent that exposes Azure users to attack. An attacker could exploit OMIGOD vulnerabilities to execute code remotely or elevate privileges on vulnerable Linux virtual machines running on Azure.
4. Malware attack on aviation sector uncovered after two years
A targeted phishing campaign aimed at the aviation industry for two years may be spearheaded by a threat actor operating out of Nigeria. The actor doesn't seem to be technically sophisticated, using off-the-shelf malware since the beginning of its activities without developing its own malware.
5. Apple patches operating systems due to spyware exploit
In mid-September, Apple was forced to issue an emergency security update for its iPhone, iPad, Mac and Watch operating systems after being alerted to a no-click exploit. "The business of selling zero-day vulnerabilities is a lucrative business practice and has well-established roots," noted Keatron Evans, principal security researcher at Infosec.
6. A new wave of malware attack targeting organizations in South America
A spear-phishing campaign aimed at South American organizations has retooled its techniques to include a wide range of commodity remote access trojans and geolocation filtering to avoid detection. The infection chain commences when the message recipients open a decoy PDF or Word document that claims to be a seizure order tied to their bank accounts.
7. Customer care giant TTEC hit by ransomware
TTEC is dealing with disruptions from a network security incident resulting from a ransomware attack in early September. TTEC’s own message to employees suggests the company’s network may have been hit by the ransomware group Ragnar Locker. The hacker group threatened to publish the full data of victims who seek help from law enforcement.
8. Ransomware attacks growing more sophisticated
Cybercriminals attacked with gusto in the first half of 2021 and attacks show no signs of slowing down. In just the first half of the year, malicious actors exploited dangerous vulnerabilities across different types of devices and operating systems, leading to major attacks that shut down fuel networks and extracted millions from enterprises.
9. New Elon Musk Club crypto giveaway scam promoted via email
A new Elon Musk-themed cryptocurrency giveaway scam called the Elon Musk Mutual Aid Fund or Elon Musk Club is being promoted through spam email campaigns that started over the past few weeks. The phishing emails themselves are low effort and include strange non-descriptive subjects and messages. However, they include an HTML attachment that launches the attack.
10. New banking Trojan that abuses YouTube for remote config
ESET researchers spotted a new LATAM banking trojan, tracked as Numando, that abuses YouTube, Pastebin, and other public platforms as C2 infrastructure and to spread. The threat actor behind this banking Trojan has been active since at least 2018, it focuses almost exclusively on Brazil but experts spotted rare attacks against users in Mexico and Spain.
In this Series
- Cybersecurity Weekly: REvil decryptor, AT&T loses millions, OMIGOD flaw
- Canada Flipper Zero ban and new RustDoor macOS malware
- AnyDesk hack and iPhone patched kernel flaw
- Tesla Pwn2Own hacks and iOS push alerts abuse
- TeamViewer breach and Atlassian Jira outage
- Moscow ISP revenge hack and Microsoft Sharepoint bug warning
- X verified accounts hack and SpectralBlur macOS malware
- CISA default password alert and SOHO KV-botnet campaign
- New 5G modem flaws and Apple’s data breach report
- Staples cyberattack, Agent Racoon backdoor and other news
- British Library ransomware attack, Windows fingerprint authentication bypass
- Samsung UK data breach and ransomware actor’s SEC complaint
- ICBC ransomware attack and ChatGPT outage
- Boeing Lockbit ransomware attack, Apple’s vulnerability and WhatsApp mods spyware
- Octo Tempest hacking group and new iLeakage attack
- Okta support system breach and Google Ads fake KeePass campaign
- Skype DarkGate malware, Shadow PC breach and AvosLocker ransomware warning
- 23andMe data theft, MGM’s $100M ransomware loss and the Azure VM breach
- Malicious Bing Chat ads and FBI’s dual ransomware warning
- T-Mobile app glitch and fake Booking.com pages
- Airbus data leak, Cisco Webex ad malware and €345 million TikTok fine
- New Apple iMessage exploit and CISA’s Apache RocketMQ warning
- Forever 21 data breach and Android BadBazaar espionage
- Duolingo data leak and the Met Police IT hack
- Discord.io data breach and Ivanti Avalanche vulnerabilities
- UK Electoral Commission hack and Microsoft’s role in China email breach
- Salesforce email zero-day exploit and Microsoft Power Platform criticism
- Airlines disclose pilot data breach and the Microsoft Teams bug
- GravityRAT Android Trojan and new MOVEit Transfer flaw
- University of Manchester hack and Honda API flaws
- MOVEit zero-day exploit and the U.S. iPhone hack accusation
- Daam Android virus and Barracuda zero-day flaw
- TP-Link router exploit and 18-year-old charged with hacking DraftKings accounts
- Discord support hack and Toyota location data leak
- Twitter private tweets bug and Cisco phone router vulnerabilities
- Cisco XSS zero-day flaw and PaperCut vulnerabilities
- 3CX hackers hit critical infrastructure and secondhand routers cause security concerns
- Hyundai data breach and Microsoft’s warning to accountants
- Western Digital cloud breach and the MSI ransomware hack
- TMX loan data breach, Italy bans ChatGPT and WordPress Elementor Pro exploit
- ChatGPT data leak and Gmail message theft by North Korean hackers
- U.S. federal agency hack and the return of FakeCalls Android malware
- Massive AT&T data breach and fake jobs targeting security researchers
- U.S. Marshals service breach and TPM 2.0 security flaws
- Dangerous ChatGPT apps and food giant Dole ransomware attack
- GoDaddy malware installations, record-breaking DDoS attack and the new WhiskerSpy malware
- Reddit’s employees phished, healthcare firms targeted and the new Screenshotter malware
- JD Sports data breached, VMware ESXi servers attacked and the HeadCrab malware
- Yandex source code leaked, 4500+ WordPress sites hacked and the new SwiftSlicer malware
- PayPal accounts breached, Fortinet VPN flaw exploited, and the new Hook malware
- Twitter users’ emails leaked, ChatGPT used to write malware and Slack’s repository breach
- Reduce security events
- Reinforce cyber secure behaviors
- Strengthen cybersecurity culture at your organization
