18.02.2022
NEWS:
Fraud and scam activity hits all-time high
Bolster published a report which shows an unprecedented level of fraud activity, spurred by the continuing growth of digital commerce, leading to an explosion of companies’ external attack surfaces. Using data gathered from analyzing more than one billion sites, the 2022 State of Phishing and Online Fraud Report highlights the trends that drove digital scams in 2021. In this, the company’s third year of tracking phishing and scam data, we can see with no uncertainty how the pandemic has impacted, and in fact accelerated, digital adoption and, as a result, cyber fraud.
FBI Warns of BEC Scams Abusing Virtual Meeting Platforms
The Federal Bureau of Investigation (FBI) this week issued an alert regarding the increasing use of virtual meeting platforms to conduct business email compromise (BEC) and email account compromise (EAC) scams. As part of such schemes, attackers target employees who can make or authorize payments, using social engineering to trick them into transferring funds into fraudulent accounts. Typically, such schemes are carried out over email (either business or personal email addresses), but over the past three years the FBI’s Internet Crime Complaint Center (IC3) has seen an increase in complaints related to BEC attacks carried out over virtual meeting platforms.
https://www.securityweek.com/fbi-warns-bec-scams-abusing-virtual-meeting-platforms
EU Data Protection Watchdog Calls for Ban on Pegasus-like Commercial Spyware
The European Union’s data protection authority on Tuesday called for a ban on the development and the use of Pegasus-like commercial spyware in the region, calling out the technology’s “unprecedented level of intrusiveness” that could endanger users’ right to privacy.
https://thehackernews.com/2022/02/eu-data-protection-watchdog-calls-for.html
Traditional MFA is creating a false sense of security
A report from HYPR and Cybersecurity Insiders, reveals that despite the zero trust initiative, many organizations are still highly exposed to credential attacks due to insufficient multi-factor authentication (MFA) methods and overall lack of urgency after potential exposure. In fact, 64% of those hacked did not enhance or improve their authentication controls following the attack. The findings also revealed that the perpetual cyber risk of remote work continues to drive passwordless adoption amongst organizations on a global scale.
INCIDENTS:
Canada’s major banks go offline in mysterious hours-long outage
Five major Canadian banks went offline for hours blocking access to online and mobile banking as well as e-transfers for customers. The banks reportedly hit by the outage include Royal Bank of Canada (RBC), BMO (Bank of Montreal), Scotiabank, and the Canadian Imperial Bank of Commerce (CIBC).
Russian Cyberspies Stole U.S. Defence Data in Attacks on Contractors
Cleared defense contractors working with the United States government have been targeted by Russian cyberspies whose goal is to obtain sensitive defense and intelligence data, according to an advisory issued on Wednesday by U.S. agencies. The advisory comes from the FBI, NSA and the DHS’s Cybersecurity and Infrastructure Security Agency (CISA). The agencies claim that Russian state-sponsored threat actors have regularly targeted defense contractors from at least January 2020 until now. The targeted contractors support the Pentagon and the intelligence community with communications, combat systems, intelligence, surveillance, reconnaissance, weapons and missile development, vehicle and aircraft design, software development, data analytics and logistics.
https://www.securityweek.com/russian-cyberspies-stole-us-defense-data-attacks-contractors
DDoS attacks knock Ukrainian government, bank websites offline
Unknown attackers have mounted disruptive distributed denial-of-service (DDoS) attacks against several Ukrainian government organizations and state-owned banks on Tuesday. The websites of the Ministry of Defence and the armed forces became temporarily unavailable. “The attackers probably knew that the site was protected from classic DDoS attacks, so they resorted to finding vulnerabilities in the code of the site itself. We can state that, unfortunately, they succeeded,” the Ministry of Defence shared via their Facebook page.
MALWARE:
Microsoft Teams Targeted With Takeover Trojans
Threat actors are infiltrating the increasingly popular collaboration app to attach malicious files to chat threads that drop system-hijacking malware.
Threat actors are targeting Microsoft Teams users by planting malicious documents in chat threads that execute Trojans that ultimately can take over end-user machines, researchers have found.
Clever Malware Masquerades as Windows 11 Installer
Microsoft announced Windows 11 last year, but deploying the update to existing devices has been a slow process. In fact, Microsoft isn’t even providing the update on PCs that lack certain modern hardware features. Anyone who goes looking for a manual upgrade to Windows 11 might find themselves on the receiving end of a nasty malware attack, according to HP security researchers. A Russian website disguised as an official Microsoft page is distributing an “upgrade installer” that won’t get you Windows 11. What it will get you is a bunch of malware. The site in question is windows-upgraded[.com], and we strongly suggest you don’t visit it (you probably won’t be able to as it appears to be decommissioned).
https://www.extremetech.com/internet/331675-clever-malware-masquerades-as-windows-11-installer
VULNERABILITIES:
VMware Issues Security Patches for High-Severity Flaws Affecting Multiple Products
VMware on Tuesday patched several high-severity vulnerabilities impacting ESXi, Workstation, Fusion, Cloud Foundation, and NSX Data Center for vSphere that could be exploited to execute arbitrary code and cause a denial-of-service (DoS) condition.
https://thehackernews.com/2022/02/vmware-issues-security-patches-for-high.html
Intel Software and Firmware Updates Patch 18 High-Severity Vulnerabilities
Intel has released software and firmware updates to address many vulnerabilities found in the company’s products. The chipmaker last week released 22 security advisories, including seven that have an overall severity rating of “high.”
New Chrome 0-Day Bug Under Active Attack – Update Your Browser ASAP!
Google on Monday rolled out fixes for eight security issues in the Chrome web browser, including a high- severity vulnerability that’s being actively exploited in real-world attacks, marking the first zero-day patched by the internet giant in 2022. The shortcoming, tracked CVE-2022-0609, is described as a use- after-free vulnerability in the Animation component that, if successfully exploited, could lead to corruption of valid data and the execution of arbitrary code on affected systems. “Google is aware of reports that an exploit for CVE-2022-0609 exists in the wild,” the company said in a characteristically brief statement acknowledging active exploitation of the flaw.
https://thehackernews.com/2022/02/new-chrome-0-day-bug-under-active.htmlCyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
