Cybersecurity Weekly: Vaccine phish, firewall evasion, VMware authentication fix
Phishing attacks use vaccine surveys to steal personal info. Hackers are using a Windows OS feature to evade firewalls. VMware fixes an authentication bypass. All this, and more, in this week’s edition of Cybersecurity Weekly.
1. Phishing attacks use vaccine surveys to steal personal info
The U.S. Department of Justice warned of phishing attacks using fake post-vaccine surveys to steal money from people or tricking them into handing over their personal information. Attackers promise potential victims cash or prizes for filling out the fake surveys. Instead, they only harvest the personally identifiable information to fuel fraud schemes.
2. Hackers using a Windows OS feature to evade firewall
A novel hacking technique finds ways to use Microsoft's Background Intelligent Transfer Service to deploy malicious payloads on Windows machines. Last year, hospitals, retirement communities and medical centers bore the brunt of an ever-shifting phishing campaign that distributed custom backdoors such as KEGTAP.
3. VMware fixes authentication bypass
VMware addressed a critical vulnerability in the VMware Carbon Black Cloud Workload appliance that could be exploited by attackers to bypass authentication. An attacker can manipulate an URL on the administrative interface of the VMware Carbon Black Cloud Workload appliance to bypass authentication.
4. Over $4 billion lost to cyber crime in 2020
In its 2020 Internet Crime Report, the FBI revealed that the Internet Crime Complaint Center received a record number of complaints from the American public in 2020. It received a total of 791,790 reports during the 12-month period, a 69% increase compared to 2019, with reported losses exceeding $4.1 billion.
5. Ransomware gang wanted $40 million in Florida schools cyberattack
Fueled by large payments from victims, ransomware gangs are demanding ridiculous ransoms from organizations that can not afford to pay them. An example of this is a recently revealed ransomware attack on the Broward County Public Schools district where threat actors demanded a $40,000,000 payment.
6. Coinhive domain repurposed to warn visitors of hacked sites
After taking over the domains for the notorious Coinhive in-browsing Monero mining service, a researcher is now displaying alerts on hacked websites that are still injecting the mining service's JavaScript. While Coinhive was used legitimately in a few cases, the majority of times, it was used to illegally mine cryptocurrency without a user's permission.
7. Man charged with hacking water system and endangering lives
A 22-year-old man from Kansas has been indicted on charges that he fraudulently accessed a public water facility's computer system, jeopardizing the residents' safety and health in the local community. The threat actor used the compromised endpoint to shut down the cleaning and disinfecting processes at the facility.
8. Hackers set up a fake cybersecurity firm to target security experts
A campaign targeting cybersecurity researchers with malware re-emerged with new tactics in their arsenal as part of a fresh social engineering attack. The new website claims the company is an offensive security company located in Turkey that offers pentests, software security assessments and exploits.
9. 533 million Facebook users' personal data leaked online
Personal information associated with approximately 533 million Facebook users worldwide was leaked on a popular cybercrime forum for free. The data seems to have been obtained by exploiting a vulnerability that enabled automated scripts to scrape Facebook users' public profiles and associated private phone numbers.
10. A $5.7 million crypto heist sent social tokens into free fall
Last week, a hack sunk the value of several social tokens minted and distributed on the social money platform, Roll. The WHALE, RARE and PICA currencies were all hit by more than 50% in price as an attacker made off with almost 3000 ETH, or about $5.7 million.
In this Series
- Cybersecurity Weekly: Vaccine phish, firewall evasion, VMware authentication fix
- Canada Flipper Zero ban and new RustDoor macOS malware
- AnyDesk hack and iPhone patched kernel flaw
- Tesla Pwn2Own hacks and iOS push alerts abuse
- TeamViewer breach and Atlassian Jira outage
- Moscow ISP revenge hack and Microsoft Sharepoint bug warning
- X verified accounts hack and SpectralBlur macOS malware
- CISA default password alert and SOHO KV-botnet campaign
- New 5G modem flaws and Apple’s data breach report
- Staples cyberattack, Agent Racoon backdoor and other news
- British Library ransomware attack, Windows fingerprint authentication bypass
- Samsung UK data breach and ransomware actor’s SEC complaint
- ICBC ransomware attack and ChatGPT outage
- Boeing Lockbit ransomware attack, Apple’s vulnerability and WhatsApp mods spyware
- Octo Tempest hacking group and new iLeakage attack
- Okta support system breach and Google Ads fake KeePass campaign
- Skype DarkGate malware, Shadow PC breach and AvosLocker ransomware warning
- 23andMe data theft, MGM’s $100M ransomware loss and the Azure VM breach
- Malicious Bing Chat ads and FBI’s dual ransomware warning
- T-Mobile app glitch and fake Booking.com pages
- Airbus data leak, Cisco Webex ad malware and €345 million TikTok fine
- New Apple iMessage exploit and CISA’s Apache RocketMQ warning
- Forever 21 data breach and Android BadBazaar espionage
- Duolingo data leak and the Met Police IT hack
- Discord.io data breach and Ivanti Avalanche vulnerabilities
- UK Electoral Commission hack and Microsoft’s role in China email breach
- Salesforce email zero-day exploit and Microsoft Power Platform criticism
- Airlines disclose pilot data breach and the Microsoft Teams bug
- GravityRAT Android Trojan and new MOVEit Transfer flaw
- University of Manchester hack and Honda API flaws
- MOVEit zero-day exploit and the U.S. iPhone hack accusation
- Daam Android virus and Barracuda zero-day flaw
- TP-Link router exploit and 18-year-old charged with hacking DraftKings accounts
- Discord support hack and Toyota location data leak
- Twitter private tweets bug and Cisco phone router vulnerabilities
- Cisco XSS zero-day flaw and PaperCut vulnerabilities
- 3CX hackers hit critical infrastructure and secondhand routers cause security concerns
- Hyundai data breach and Microsoft’s warning to accountants
- Western Digital cloud breach and the MSI ransomware hack
- TMX loan data breach, Italy bans ChatGPT and WordPress Elementor Pro exploit
- ChatGPT data leak and Gmail message theft by North Korean hackers
- U.S. federal agency hack and the return of FakeCalls Android malware
- Massive AT&T data breach and fake jobs targeting security researchers
- U.S. Marshals service breach and TPM 2.0 security flaws
- Dangerous ChatGPT apps and food giant Dole ransomware attack
- GoDaddy malware installations, record-breaking DDoS attack and the new WhiskerSpy malware
- Reddit’s employees phished, healthcare firms targeted and the new Screenshotter malware
- JD Sports data breached, VMware ESXi servers attacked and the HeadCrab malware
- Yandex source code leaked, 4500+ WordPress sites hacked and the new SwiftSlicer malware
- PayPal accounts breached, Fortinet VPN flaw exploited, and the new Hook malware
- Twitter users’ emails leaked, ChatGPT used to write malware and Slack’s repository breach
We’ll customize our demo to your
- Security awareness goals
- Existing security and employee training tools
- Industry and compliance requirements
