Threat Intel Hub

TikTok was fined £27 million for storing the data of users under the age of 13 without their permission and for gathering excessive identifiable information without legal reasoning. In other cybersecurity news, American Airlines suffered a data breach that was initiated through a compromised employee email account.Fraudulent mobile apps installed over 13 million timesResearchers have been tracking 85 mobile apps that are active on the Google Play and Apple stores, that have a combined 13 million downloads. These apps are all tied to the ‘Scylla’ malware campaign that floods the victim’s device with ads and is believed to be the third wave of a campaign that started back in 2019. Fortunately, both Google and Apple have already removed these malicious apps and have updated their security to block related apps in the future.Hacker behind Optus breach apologizes and deletes dataOver the weekend, the hacker taking responsibility for the recent Optus data breach issued an apology to the 10,0

Early this week, all operations at Japan’s largest port, the Port of Nagoya were brought to a halt after a ransomware attack was discovered on their internal network. The attack caused disruptions to the port’s terminal processing system for shipping containers and forced officials to cancel all transportation in and out of the port, until they were able to restore normal system functionality. The Port of Nagoya is responsible for handling over 2 million shipping containers each year, which equates to 10% of Japan’s annual trade volume.Android banking trojan targets financial institutions across the globeResearchers have identified an Android malware campaign that has been targeting banking organizations across numerous countries for 2 years and compromised sensitive banking information for thousands of individuals. It is believed that one Mexico-based hacker, known as Neo_Net, is behind this campaign, which uses SMS phishing messages to lure in victims and disguises itself as a variet

Officials for the automotive manufacturer, Volkswagen, have confirmed that their internal network was breached by hackers and resulted in the exfiltration of 19,000 files. Based on the content of the targeted files, it is believed that the hackers were focused exclusively on proprietary technology and have been traced back to threat groups located in China. Fortunately, Volkswagen staff were quick to identify the breach and are working to improve their security standings, as well as assist global law enforcement agencies in tracking the suspects.Frontier Communications works to restore services after cyberattack Following a cyberattack early last week, officials for the telecom provider, Frontier Communications, are working diligently to restore internet services that were taken offline after discovering unauthorized activity on their internal network. Due to this incident's nature, it is likely that some customer information was illicitly accessed and may be used for future phishing a

Late last week, an unaffiliated threat actor began publishing stolen data belonging to HCA Healthcare, one of the largest healthcare facility operators in the US. Upon further investigation, it has been confirmed that sensitive health records for over 11 million patients have been compromised and listed for sale, as HCA has chosen not to pay the demanded ransom. The stolen data could easily be used for nefarious purposes such as phishing attacks and other social engineering scams.Former water plant employee charged with software tamperingA former employee of the Discovery Bay water treatment plant in California has been charged with remotely accessing the plant’s IT systems and uninstalling vital water management software. Shortly after his resignation in January of 2021, the individual used remote access software to infiltrate his former employer and make malicious changes to their operations. He has been charged with a single count of intentionally causing damage to a protected compu

Activision games confirmed a significant amount of sensitive employee information was compromised after a successful SMS phishing attack caused a December data breach. In other cybersecurity news, web hosting company GoDaddy has struggled to contain malware that was introduced during a data breach and has caused redirects since December. Hacktivists target Scandinavian Airlines in cyberattackScandinavian Airlines faced outages on both their website and mobile app after falling victim to a cyberattack that temporarily allowed active system users to view some personally identifiable information (PII) of other active users. Fortunately, Scandinavian Airlines doesn’t store excessive data on their customers. That means the impact of any potentially leaked data would be minimal, though the threat of phishing attacks is still present. The hacktivist group known as ‘Anonymous Sudan’ is taking credit for the attack, and claim it was done in response to a political protest last month in Sweden.E

Researchers have been tracking a non-malicious screen recording app, iRecorder, which has received an update that included the AhRAT remote access trojan and allowed the exfiltration of voice and screen recordings from the infected device. By injecting AhRAT into the iRecorder app, the malicious code gained the recording permissions from the app to gather data from the device without requiring any additional user input. The malicious version of iRecorder had been downloaded over 50,000 times before the Google Play Store was able to remove it.Data leaks force Luxottica to confirm 2021 breachSeveral weeks after a database containing sensitive information on 74 million individuals was posted to a leak site, officials for the eye-wear magnate Luxottica have finally confirmed that one of their partners had suffered a breach in March of 2021. It was also revealed that the company first learned of the incident in November of 2022, nearly 20 months after the breach occurred, and did not begin

Recently, the threat actors behind the Qilin ransomware group added a significant amount of sensitive data belonging to the automotive parts supplier, Yanfeng, to their dark web leak site. It was reported that a disruption occurred at their North American manufacturing facilities on November 13th, but the company was not forthcoming with any additional information on the incident and has yet to release a statement regarding the disruptions. It is unclear how long Yanfeng officials will have to negotiate the release of their stolen data, but the Qilin leak site states that they will publish the data shortly.ALPHV/BlackCat ransomware targets Fidelity National FinancialEarly last week, officials for Fidelity National Financial (FNF) confirmed that they had fallen victim to a cybersecurity attack and were forced to take several of their internal systems offline. It is believed that the ALPHV/BlackCat ransomware group are responsible for the intrusion and the group has added FNF to their da

Tennessee State University and Southeastern Louisiana University are just the latest higher education institutions to suffer a successful ransomware attack. In other cybersecurity news, the Hospital Clinic de Barcelona was forced to temporarily shut down operations after discovering unauthorized activity on their internal systems.Million-dollar ransom demanded from Minneapolis school districtTwo weeks after suffering a ransomware attack that caused significant interruptions to the Minneapolis Public Schools (MPS) computer systems, the district has received a ransom demand for $1 million to delete or return all stolen data. Alongside the ransom demand was a video that showed proof of the Medusa ransomware group’s access to the school district's systems, which is an improved tactic of simply posting screenshots of a victim’s computer. While the investigation into this security incident is still ongoing, officials for MPS have confirmed that they will be restoring any encrypted data from

Tallahassee Memorial Hospital was forced to shut down their network after discovering suspicious activity and had to divert all incoming emergencies. The hospital is still investigating whether any patient information was stolen. In other cybersecurity news, Lorenz ransomware compromised a pharmaceutical distributor and published a trove of data they claim to have stolen.PeopleConnect confirms data leak on 20 million customersRecently, an unknown hacker posted 2 CSV (Comma Separated Value) files to a leak site, that contained backup data for two background check services that are owned by PeopleConnect, and exposed sensitive data on 20 million customers. It is believed that the leaked data only contains information on people who used either TruthFinder or Instant Checkmate background check services from 2011 up to the backup occurrence in April of 2019. Officials for PeopleConnect have begun contacting all affected customers and are working with third-party firms to investigate how the

Researchers have been monitoring a new phishing campaign that uses malicious QR codes to infiltrate business emails by avoiding typical security protocols. Of the 1,000 identified phishing emails, 29% of them were focused on a single US energy provider, with the remainder targeting several other industries. Victims of this campaign initially receive an email asking to update their Microsoft 365 settings and are given a QR code to scan that allegedly verifies their account but contains an embedded URL redirect to a phishing site.Data breach impacts 1.47 million dental patientsOfficials for Alberta Dental Service Corporation (ADSC) have confirmed a 2-month long data breach of their systems that has exposed sensitive patient data for 1.47 million individuals. The breach was first identified on July 9th, roughly 2 months after the attackers gained access to the system and began deploying info stealing malware and partially encrypting stored patient data. Fortunately, ADSC has begun contact

T-Mobile admins recently discovered unauthorized activity through an internal API that allowed hackers to access the data for 37 million of their customers. In other cybersecurity news, hackers have demanded $10 million from Riot Games after stealing source code during an attack.Hackers demand $10 million ransom for stolen Riot Games source codeFollowing a data breach last week, officials for Riot Games have received a ransom demand of $10 million in exchange for hackers both deleting the code and not publicly leaking it. It is believed the stolen source code includes sensitive documentation on the company’s anti-cheat applications and internal documentation on unreleased games. Riot Games is the third game-development company to have been targeted by a cyber-attack in as many months, which also focused on stealing source code for a variety of games and other sensitive company IP (Intellectual Property).Ireland’s Data Protection Commission (DPC) fines WhatsApp for GDPR violationsWhatsA

Be sure to join the Webinar!  In today’s evolving threat landscape, cyber defenders are constantly adapting to new adversarial tactics and emerging vulnerabilities. The latest 2024 Threat Hunter Perspective from OpenText™ sheds light on the most pressing threats, nation-state activities, and security recommendations enterprises must consider in the months ahead. Here are the key findings and expert insights to help you stay ahead of the curve. Nation-state collaboration with cybercrime ringsOne of the standout trends identified in the report is the increasing collaboration between nation-state actors and cybercrime rings. Adversaries are more coordinated than ever, launching synchronized attacks aimed at maximizing disruption and confusion.Russia: Cyber operations are ongoing, with particular focus on Ukraine and NATO countries, often leveraging criminal groups like Killnet and Lokibot to amplify attacks. China: Expanding its focus to South China Sea neighbors, China often partners wit

This short webinar is a 'show and tell' session that will demonstrate the new features and improvements we have made to the Webroot Console this month. It's intended for Webroot customers who use our business Endpoint; DNS Protection or Security Awareness Training solutions. The highlights of the release are: Improved – Agent Commands New – Reports New – Scan History New – Policy-based Web Overrides for DNS Protection New – My Usage Page New – Dark Web Breach Report New – Training Navigation Enhancements Click here to watch *You will need to register to watch the webinar. Registration is FREE.

An increase in attacks by Emotet has been observed. Emotet uses Excel 4.0 macros to execute payloads on systems running Microsoft Office to gain access, steal data and perform other malicious acts.These attacks usually appear in the form of an email with an attachment asking the user to open the file and take further action. Emotet is part of an attack chain that can lead to compromised credentials, exfiltrated data and ransomware attacks. This is the most common infection vector for RansomwareThe latest patches ensure that Excel 4.0 macros are disabled by default. Please see more info here from Microsoft and CISA on our FAQ

Recently, officials for the trucking and fleet management provider ORBCOMM confirmed that they had suffered a ransomware attack that was impacting their tracking and data logging services for several of the largest trucking firms in the US. The outages for the Electronic Logging Devices (ELD) were also causing truckers to record their driving hours on paper, which is only allowed for 8 out of 30 consecutive days, per federal regulations, though a waiver has been instituted until September 29th. All affected customers were made aware of the attack shortly after its discovery, though the investigation into which group was behind the attack is still underway.TransUnion breach data leaked on BreachForumsOver the weekend, researchers discovered a 3GB data trove on the dark web forum, BreachForums, that claims to have been stolen from a TransUnion breach last year. It is believed that the stolen database contains a significant amount of sensitive customer and employee data dating back to Mar

Recently, officials for Sony Interactive Entertainment confirmed that one of their Japanese servers had been affected by the MOVEit data transfer vulnerability and had exposed sensitive information on nearly 6,800 individuals. The responsible group, Cl0p ransomware, had added Sony to their leak site back in June but nothing had been confirmed by the company until last week. Staff at Sony are also currently investigating another data breach, in which two separate threat groups are both claiming to have illicitly obtained a 3.14GB data trove from the company and have posted it for sale on a known hacker forum.Google identifies multiple zero-day vulnerabilities in computer chipsBoth Qualcomm and Arm chip manufacturers were contacted by the Google Threat Analysis Group about a number of zero-day vulnerabilities that had been found in several of their devices, which could be exploited by threat actors. Both companies have identified the listed vulnerabilities and have begun pushing out patc

Over the weekend, one of the largest payment solutions providers, NCR, confirmed that the data centers for their Aloha POS (Point of Sale) software had been compromised by a ransomware attack. The BlackCat/ALPHV ransomware group claimed responsibility for the attack and stated that instead of stealing the data stored on the Aloha servers, they had taken all the client credentials, and were expecting a ransom to be paid before posting the full list to their leak site.Custom PowerShell tool allowing threat actors to silently exfiltrate dataResearchers have identified several instances of the Vice Society ransomware group using a custom PowerShell script to exfiltrate data from a victim’s system without raising any warnings. The script runs a series of jobs to identify files and directories that are on the inclusion list, looking for keywords, and avoiding files smaller than 10KB. By concentrating on a smaller scope of files and criteria, it minimizes the drain on device resources to avoi