Weekly News Digest #57

Massive phishing and malware campaign disrupted by Google

The malware campaign was focused on hijacking Youtube accounts and promoting cryptocurrency scams. Since May 2021 Google has blocked 1.6 million phishing emails that have been part of this malware campaign. According to the data provided by Google’s Threat Analysis Group, a network of Russian hacker subcontractors have been targeting YouTubers using cookie-stealing malware and phishing emails. By carrying out their malware campaign, attackers were live-streaming scams offering free crypto for initial contribution. 

The malicious group was also getting revenue by selling hijacked YouTube accounts the price of which was ranging from $3 to $4,000. The price of an account on the black market depended on the number of subscribers. Google has already displayed 62,000 Safe Browsing phishing alerts and restored close to 4,000 hijacked accounts. The malware delivered by phishing emails has been designed to steal session cookies from browsers.

Read more

Ransom was paid by 83% of victims

According to a survey of 300 US-based decision-makers, 64% of them have fallen victim to a ransomware attack for the last 12 months and 83% of the victims have agreed to pay the ransom. The survey was conducted by the cybersecurity company ThycoticCentrify. 72% of the companies surveyed have increased their cybersecurity budgets due to the increasing ransomware threats. Close to 50% of respondents admitted experiencing the loss of revenues and reputational damage due to ransomware attacks and 42% of respondents admitted losing clients. 

Emal (53%), applications (41%), and cloud (38%) were the most vulnerable vectors for ransomware attacks. The most popular step taken by companies to address threats associated with ransomware attacks was the backup of critical data and regular updates of software and systems. The results of this survey have not surprised experts since many corporations have published info regarding paying ransom to cybercriminals. 

Read more

Threat actors spread malware by abusing Discord

The new multi-function malware discovered by researchers has been abusing the core functions of Discord. Several malicious GitHub repositories were found by Check Point. The repositories were featuring malware based on Discord API and malicious bots. According to researchers, by applying simple manipulations malicious actors can turn Discord bots into Remote Access Trojan (RAT). To this end, they don’t even need to download the Discord app to the targeted machine.

It’s very difficult to detect malware since the communication between attacker, Discord server, and victim’s machine is encrypted by Discord. As a result, attackers can easily infect machines and turn them into malicious bots. The only way to prevent Discord malware is to disable all Discord bots. However, this measure may heavily affect the Discord community. 

Read more

Bit-and-Piece DDoS attacks: Skyrocketing growth in 2021

Bit-and-piece DDoS attacks soared by 233% in the first half of 2021. The data are provided by Nexusguard researchers in the Threat Report FHY2021. Bit-and-piece attacks target ASN-lever CSP networks by dispersing small pieces of junk traffic across a wide range of IP addresses as well as across hundreds of IP prefixes. Thereby these DDoS attacks are evading detection. 99% of DDoS attacks detected in 2021 were smaller than 10 Gbps. According to Nexusguard, malicious actors will keep on diversifying methods they use to target networks and infrastructures.

Malicious actors are using small-sized traffic they can get from cheap DDOS-for-hire services. Nexusguards also estimates that UDP-style attacks and traffic spoofing demonstrated an 84% increase in the first half of 2021. Nexusguard warns that one type of UDP-style attack may theoretically cause so-called “Black-Storm” attacks. The volume from the Black-Storm attack could terminate medium to large-sized enterprises. 

Read more

Users of popular dating apps like Bumble or Tinder are at risk. Cryptocurrency hackers are coming after you

Spammers are leveraging Enterprise Signature to access users’ iPhones. Enterprise Signature is a system used by software developers to help businesses pretest their new iOS applications with selected iPhone users before these apps appear on the official Apple App Store. Hackers are luring crypto users who use popular dating apps in Europe, Asia, and the USA. The security company Sophos has uncovered a Bitcoin wallet controlled by attackers with $1.4 mln in virtual assets. The threat code identified by security researchers is called CryptoRom and it relies on social engineering.

Attackers pose convincing profiles on legitimate dating websites. Then attackers enter into communication with a potential victim. The purpose of this communication is to persuade a target to install a fake crypto trading app. Using this scam mechanism, attackers are getting access to millions of dollars. 

Read more