Threat Intelligence Bulletin: 07/29/2022 - 08/04/2022

Q2 2022: Quarterly Threat Landscape Report

Product Serial: S-2022-07-21a

TLP: GREEN

ZeroFox Intelligence is excited to announce the release of our Quarterly Threat Landscape for Q2 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Executive Summary

ZeroFox Intelligence collected and analyzed developments around key cyber threats during Q2 2022, and several trends stood out at the conclusion of the analysis. Notably, with the ongoing conflict in Ukraine, well-regarded threat actors continue to exchange ideas on how to maneuver within the new economic and political constraints. Immediate concerns continue to center around the fate of cryptocurrency funds and potential strategies to exchange them for fiat currency that can be spent. In addition, social engineering campaigns remained a persistent threat to organizations across the threat landscape this quarter, with threat actors very likely to continue targeting desirable employees in job-related scams—especially those in leadership positions who have elevated access levels, potentially leading to financial harm or corporate exposure.

The threat from vulnerability exploitation continued on an upward trajectory, most likely representing a new normal for the exploit landscape. ZeroFox Intelligence anticipates that threat actors will continue to leverage high-profile vulnerabilities in widely-used software—such as the Follina, Confluence, and F5 BIG IP applications—long after the security patches were released. Moreover, after a fall in activity in Q1 2022, the threat from Initial Access Brokers showed signs of resurgence. Threat actors may be pushed increasingly to more private means to sell illicit access, making the identification of activity more difficult. Botnet and malware deployment remained high, including from infostealers and banking trojans. To that end, high saturation of Malware-as-a-Service offerings will very likely continue to sustain low barriers to entry for threat actors and drive down the price of acquiring highly-capable malware.

Despite a drop in the number of ransomware and digital extortion attacks in Q2 2022, the overall threat remained broadly consistent with the previous quarter—albeit with threat actors conducting more damaging attacks. The healthcare and retail industries in particular experienced a resurgence in targeting. ZeroFox Intelligence also observed that ransomware threat actors may be struggling to elicit payments from victims, driving changes to extortion tactics. This may ultimately lead these actors to resort to more extreme pressure tactics in an attempt to cause greater operational downtime and reputational damage, which may have legal ramifications.

Lastly, the ongoing war in Ukraine continued to be the primary driver of geopolitical risk across the quarter and heavily influenced the cyber threat landscape. As the conflict in Ukraine continues on, issues like European Union/North Atlantic Treaty Organization membership and new sanctions on Russia are likely to trigger a Russian state response, which often coincides with Russian-backed groups targeting sensitive infrastructure.

Key Findings

• Russian-speaking cybercriminals demonstrated increasing concern regarding the ability to turn cryptocurrency into fiat currency, with specific unease related to the perception that cryptocurrency may be the only way to transfer financial support to Russia.
• Social engineering remained one of the most frequently reported intrusion tactics in Q2, with notable increases in the use of LNK shortcut files and fake Windows 11 upgrades to deliver malware and employment-related scams.
• The threat from Common Vulnerabilities and Exposures and previously-unknown software vulnerabilities likely increased in Q2 2022. Sustained quarters of high vulnerability disclosures provide more routes for threat actors to attack and place increased pressure on patch management processes.
• The Initial Access Broker marketplace showed signs of resurgence in Q2 2022 despite activity levels remaining lower than in 2021, likely reflecting continued limitations in supply. Threat actors may be pushed increasingly to more private means to sell illicit access.
• Despite the widespread media attention and Russia-aligned entities starting to target nations and entities that vocally opposed the war in Ukraine with botnet attacks, the threat from botnets in Q2 2022 appears to have remained unchanged.
• Malware deployment remained highly prevalent in Q2 2022, and ZeroFox Intelligence expects that to continue.
• Despite a drop in identified incidents, the threat from ransomware and digital extortion remained largely consistent with previous quarters. Threat actors changing extortion tactics may indicate difficulty in eliciting payments from victims.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Allo Internet, a Moscow-based online store that primarily sells communication-related products suffered a data breach. On June 27, 2022, the Telegram channel "Dataleak" posted a data package relating to this breach. The threat actor who uploaded this package noted that the data dump included 110,923 records with user login and order information. The data was also shared on BreachForums (on June 20, 2022, by the threat actor "superus3r") and in the Telegram channel "KelvinSecurity - Dark Market & Leaks" (on June 25, 2022). From the package shared on Dataleak, ZeroFox extracted 98,875 email addresses. No passwords were found in this breach. Other notable compromised data fields in this package included name, phone number, email address, and physical address.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-07-29 - 2022-08-04

Microsoft: Austrian company DSIRF selling Subzero malware

Microsoft said that an Austria-based company named DSIRF used multiple Windows and Adobe Reader zero-days to hack organizations located in Europe and Central America.

See the full report here: https://arstechnica.com/information-technology/2022/07/microsoft-says-0-days-sold-by-austrian-firm-were-used-to-hack-customers/

As Microsoft blocks Office macros, hackers find new attack vectors

Microsoft's decision to end the massive abuse of the Office subsystem by automatically blocking macros by default has convinced malware operators to start experimenting with alternative methods to infect victims.

See the full report here: https://www.bleepingcomputer.com/news/security/as-microsoft-blocks-office-macros-hackers-find-new-attack-vectors/

Malicious npm packages steal Discord users’ payment card info

Multiple npm packages are being used in an ongoing malicious campaign to infect Discord users with a variant of the open-source and Python-based Volt Stealer token logger and JavaScript malware dubbed Lofy Stealer.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-npm-packages-steal-discord-users-payment-card-info/

Microsoft SQL servers hacked to steal bandwidth for proxy services

To steal a device's bandwidth, threat actors install software called 'proxyware' that allocates a device's available internet bandwidth as a proxy server that remote users can use for various tasks, from testing and intelligence collection to market research.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-sql-servers-hacked-to-steal-bandwidth-for-proxy-services/

New security features introduced by AWS

With the new GuardDuty Malware Protection tool, AWS will be able to identify malicious activity in Windows and Linux and determine malicious PDF documents, scripts, software installers, and other files.

See the full report here: https://aws.amazon.com/blogs/aws/new-for-amazon-guardduty-malware-detection-for-amazon-ebs-volumes/

EU finds evidence on employees’ smartphones compromised by spyware

In a July 25 letter sent to European lawmaker Sophie in ‘t Veld, EU Justice Commissioner Didier Reynders said iPhone maker Apple had told him in 2021 that his iPhone had possibly been hacked using the notorious spyware Pegasus.

See the full report here: https://www.reuters.com/technology/exclusive-eu-found-evidence-employee-phones-compromised-with-spyware-letter-2022-07-27/

Hacktivist group Anonymous is using six top techniques to ‘embarrass’ Russia

Anonymous uses many strategies in its digital fight against Russia, the most effective being hacking into databases and leaking the information online. The hacks have also exposed Russia’s cybersecurity defenses to be far weaker than previously believed.

See the full report here: https://www.cnbc.com/2022/07/28/how-is-anonymous-attacking-russia-the-top-six-ways-ranked-.html

Ransomware group demands £500,000 from UK school

Hive Ransomware Group has hacked Wootton Upper School and threatened to post sensitive data unless the school pays out £500,000. The group claimed to have “managed to encrypt all of Wootton organisation servers".

See the full report here: https://www.infosecurity-magazine.com/news/ransomware-group-500000-school/

Cyberspies use Google Chrome extension to steal emails undetected

A North Korean-backed threat group Kimsuky is using a malicious browser extension (SHARPEXT) to steal emails from Google Chrome or Microsoft Edge users reading their webmail. SHARPEXT supports three Chromium-based web browsers (Chrome, Edge, and Whale) and can steal mail from Gmail and AOL accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/

Akamai blocked largest DDoS in Europe against one of its customers

On July 21, a 14-hour DDoS attack peaking at 853.7 Gbps (gigabits per second) and 659.6 Mpps (million packets per second) targeted an organization in Eastern Europe.

See the full report here: https://www.bleepingcomputer.com/news/security/akamai-blocked-largest-ddos-in-europe-against-one-of-its-customers/

Microsoft 365 outage knocks down admin center in North America

Microsoft is investigating an incident affecting administrators in North America who saw blank pages and 404 errors when trying to access the Microsoft 365 admin center.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-365-outage-knocks-down-admin-center-in-north-america/

LibreOffice addresses security issues with macros, passwords

Three security vulnerabilities (CVE-2022-26305, CVE-2022-26307, and CVE-2022-26306) have been fixed in the stable release of the LibreOffice suite (LibreOffice 7.2) and the unstable branch (7.3). The latest available version on the official download portal is 7.3.5.2, which features fixes for the mentioned flaws.

See the full report here: https://www.bleepingcomputer.com/news/security/libreoffice-addresses-security-issues-with-macros-passwords/

Latest Critical Atlassian Confluence Vulnerability Under Active Exploitation

A critical flaw in the Atlassian Questions For Confluence app for Confluence Server and Confluence Data Center, for which patches were released last week, is under active exploitation. The bug (CVE-2022-26138) can be exploited by a remote, unauthenticated attacker to gain unrestricted access to all pages in Confluence.

See the full report here: https://thehackernews.com/2022/07/latest-critical-atlassian-confluence.html

Covid vaccine study to Oil India: Targets under cyber attack

The Indian parliament was informed that the country faced 674,021 cyber attacks in the country this year until June — almost 3,700 cyber attacks a day, making India the third most impacted by network attacks in the world.

See the full report here: https://indianexpress.com/article/technology/covid-vaccine-study-to-oil-india-targets-under-cyber-attack-8053555/

$10 million reward offered for information on foreign government-linked malicious hackers

The US State Department has offered a $10 million reward for information leading to the identification or location of malicious hackers working with North Korea to launch cyber attacks on US critical infrastructure.

See the full report here: https://www.tripwire.com/state-of-security/government/10-million-reward-offered-for-information-on-foreign-government-linked-malicious-hackers/

Microsoft links Raspberry Robin malware to Evil Corp attacks

An access broker (DEV-0206) is reportedly using the Raspberry Robin Windows worm to deploy a malware downloader on networks; researchers have found evidence of malicious activity matching Evil Corp tactics in such instances. This is the first time security researchers have found evidence of how the threat actors behind Raspberry Robin plan to exploit the access they gained to their victims' networks using this worm.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-links-raspberry-robin-malware-to-evil-corp-attacks/

Australia charges dev of Imminent Monitor RAT used by domestic abusers

An Australian man was charged for developing and selling the Imminent Monitor remote access trojan, used to spy on victims' devices remotely. The suspect allegedly sold the software to more than 14,500 people across 128 countries.

See the full report here: https://www.bleepingcomputer.com/news/security/australia-charges-dev-of-imminent-monitor-rat-used-by-domestic-abusers/

Huge network of 11,000 fake investment sites targets Europe

Researchers have uncovered a network of more than 11,000 domains used to promote numerous fake investment schemes to users in Europe. The platforms show fabricated evidence of enrichment and falsified celebrity endorsements to create an image of legitimacy and lure in a larger number of victims. The countries targeted are the United Kingdom, Belgium, Germany, the Netherlands, Portugal, Poland, Norway, Sweden, and the Czech Republic.

See the full report here: https://www.bleepingcomputer.com/news/security/huge-network-of-11-000-fake-investment-sites-targets-europe/

Facebook ads push Android adware with 7 million installs on Google Play

Adware apps are being promoted aggressively on Facebook as system cleaners and optimizers for Android devices, but these apps lack all of the promised functionality and push advertisements while trying to last as long as possible on the device.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-ads-push-android-adware-with-7-million-installs-on-google-play/

Meta, US hospitals sued for using healthcare data to target ads

A class action lawsuit has been filed against Meta (Facebook), the UCSF Medical Center, and the Dignity Health Medical Foundation for allegedly collecting sensitive healthcare data about patients for targeted advertising. According to the lawsuit, neither the hospitals nor Meta informs the patients about the data collection, no user consents are requested, and there is no visible indication of this process.

See the full report here: https://www.bleepingcomputer.com/news/security/meta-us-hospitals-sued-for-using-healthcare-data-to-target-ads/

CISA warns of critical Confluence bug exploited in attacks

CISA has added a critical Confluence vulnerability (CVE-2022-26138) to its list of bugs abused in the wild, which can provide remote attackers with hardcoded credentials following successful exploitation. CISA has given Federal Civilian Executive Branch (FCEB) agencies three weeks (until August 19) to patch servers and block attacks targeting their networks.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-confluence-bug-exploited-in-attacks/

US govt warns Americans of escalating SMS phishing attacks

The Federal Communications Commission (FCC) has warned Americans of an increasing wave of SMS (Short Message Service) phishing attacks attempting to steal their personal information and money. False-but-believable “smishing” baits reported by American consumers to the FCC include claims about unpaid bills, package delivery issues, bank account problems, or law enforcement actions.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-warns-americans-of-escalating-sms-phishing-attacks/

LockBit ransomware abuses Windows Defender to load Cobalt Strike

A threat actor associated with the LockBit 3.0 ransomware operation is abusing the Windows Defender command line tool to load Cobalt Strike beacons on compromised systems and evade detection by security software.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-abuses-windows-defender-to-load-cobalt-strike/

Gootkit Loader Resurfaces with Updated Tactic to Compromise Targeted Computers

The operators of the Gootkit access-as-a-service (AaaS) malware have resurfaced with updated techniques to compromise unsuspecting victims. Gootkit is part of the proliferating underground ecosystem of access brokers, who are known to provide other malicious actors a pathway into corporate networks for a price, paving the way for actual damaging attacks such as ransomware.

See the full report here: https://thehackernews.com/2022/07/gootkit-loader-resurfaces-with-updated.html

BlackCat ransomware claims attack on European gas pipeline

The ALPHV ransomware gang has claimed responsibility for a cyberattack (on July 22 and 23) on a natural gas pipeline and electricity network operator in Luxembourg. The group added the company to its extortion site on Saturday, threatening to publish 180,000 stolen files (150 GB), including contracts, agreements, passports, bills, and emails.

See the full report here: https://www.bleepingcomputer.com/news/security/blackcat-ransomware-claims-attack-on-european-gas-pipeline/

Steam, PayPal blocked as Indonesia enforces new Internet regulation

Indonesia is blocking access to internet service and content providers who had not registered on the country's new licensing platform by July 27, 2022. The new regulatory framework has been presented as a content-control system to protect national security and prevent the dissemination of fake news. It orders the mandatory registration of all internet service providers into a new licensing platform allowing them to legally operate in the country.

See the full report here: https://www.bleepingcomputer.com/news/security/steam-paypal-blocked-as-indonesia-enforces-new-internet-regulation/

Charges filed over $300m 'textbook pyramid and Ponzi scheme' crypto startup

The U.S. Securities and Exchange Commission (SEC) charged 11 people for their roles in Forsage, an alleged crypto Ponzi scheme (claiming to be a decentralized smart contract platform) that spanned the United States, Russia, the Philippines, and other countries.

See the full report here: https://www.theregister.com/2022/08/02/sec_smacks_fraudsters_in_alleged/

Over 3,200 apps leak Twitter API keys, some allowing account hijacks

Over 3,000 mobile apps are exposing Twitter API keys to the public, potentially enabling a threat actor to take over users' Twitter accounts that are associated with the app. The leak of API keys is reportedly often a result of mistakes by app developers who embed their authentication keys in the Twitter API but forget to remove them when the mobile app is released.

See the full report here: https://www.bleepingcomputer.com/news/security/over-3-200-apps-leak-twitter-api-keys-some-allowing-account-hijacks/

Semiconductor manufacturer Semikron hit by LV ransomware attack

German power electronics manufacturer Semikron has disclosed that it was hit by a ransomware attack that partially encrypted the company's network. It has over 3,000 employees in 24 offices and 8 production sites worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/semiconductor-manufacturer-semikron-hit-by-lv-ransomware-attack/

Britain's Conservative Party voting for next PM delayed after hacking alert

Voting by Britain's Conservative Party members to pick the next prime minister has been delayed after the GCHQ spy agency warned that cyber hackers could change people's ballots by tapping existing vulnerabilities.

See the full report here: https://www.telegraph.co.uk/politics/2022/08/02/tory-leadership-voting-delayed-gchq-hacking-warning/

How leaking of employee's passwords led to hacking of 140,000 credit card payment terminals

Hackers have stolen thousands of passwords to gain access to dashboards used to remotely manage and control thousands of credit card payment terminals manufactured by digital payments major Wiseasy.

See the full report here: https://timesofindia.indiatimes.com/gadgets-news/how-leaking-of-employees-passwords-led-to-hacking-of-140000-credit-card-payment-terminals/articleshow/93295662.cms

Nomad crypto hack turns into $190 million mass theft

Nomad has confirmed that its cryptocurrency bridge (which lets you swap tokens between blockchains) was the victim of an August 1st "incident" where a slew of hackers stole nearly $200 million in funds.

See the full report here: https://mashable.com/article/nomad-crypto-hack

Chinese hackers use new Cobalt Strike-like attack framework

A new post-exploitation attack framework named Manjusaka is being used in the wild. Manjusaka uses implants written in Rust, while its binaries are written in GoLang. Its RAT (remote access trojan) implants support command execution, file access, network reconnaissance, and more, so hackers can use it as an alternative to Cobalt Strike or parallel to it for redundancy.

See the full report here: https://www.bleepingcomputer.com/news/security/chinese-hackers-use-new-cobalt-strike-like-attack-framework/

Mobile store owner hacked T-Mobile employees to unlock phones

A former owner of a T-Mobile retail store has been found guilty of a $25 million scheme where he illegally accessed T-Mobile's internal systems to unlock and unblock cell phones. He reportedly unlocked devices from the cellular networks of their vendors and enabled people to use them with other telecommunication providers.

See the full report here: https://www.bleepingcomputer.com/news/security/mobile-store-owner-hacked-t-mobile-employees-to-unlock-phones/

VMware urges admins to patch critical auth bypass bug immediately

VMware has warned admins to patch a critical authentication bypass security flaw (CVE-2022-31656) affecting local domain users in multiple products (VMware Workspace ONE Access, Identity Manager, and vRealize Automation) and enabling unauthenticated attackers to gain admin privileges. According to VMware, there is no evidence that the critical CVE-2022-31656 authentication bypass vulnerability is exploited in attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-urges-admins-to-patch-critical-auth-bypass-bug-immediately/

EU missile maker MBDA confirms data theft extortion, denies breach

MBDA, one of the largest missile manufacturers in Europe, has denied the claims of a breach of its systems. The company stated that the data leaked online was acquired from an external hard drive and no hacking of the company’s secure networks has occurred.

See the full report here: https://www.bleepingcomputer.com/news/security/eu-missile-maker-mbda-confirms-data-theft-extortion-denies-breach/

New 'ParseThru' Parameter Smuggling Vulnerability Affects Golang-based Applications

Security researchers have discovered a new vulnerability called ParseThru affecting Golang-based applications that could be abused to gain unauthorized access to cloud-based applications. The issue, at its core, has to do with inconsistencies stemming from changes introduced to Golang's URL parsing logic that's implemented in the "net/url" library.

See the full report here: https://thehackernews.com/2022/08/new-parsethru-parameter-smuggling.html

Solana Wallets Targeted in Latest Multimillion Dollar Hack

Users of the Solana cryptocurrency are reporting that their funds have been drained without their knowledge from major internet-connected “hot” wallets, including Phantom, Slope, and TrustWallet. The attack appears to have predominantly impacted mobile wallet users, and over 8,000 wallets have been compromised so far.

See the full report here: https://www.coindesk.com/markets/2022/08/03/phantom-wallet-exploit-drains-millions-in-sol-tokens/

35,000 code repos not hacked—but clones flood GitHub to serve malware

Thousands of GitHub repositories were copied with their clones altered to include malware, a software engineer discovered. GitHub has purged most of the malicious repositories after receiving the engineer's report.

See the full report here: https://www.bleepingcomputer.com/news/security/35-000-code-repos-not-hacked-but-clones-flood-github-to-serve-malware/

Cloned Atomic Wallet website is pushing Mars Stealer malware

A fake website impersonating the official portal for the Atomic wallet, a popular decentralized wallet that also operates as a cryptocurrency exchange portal, is, in reality, distributing copies of the Mars Stealer information-stealing malware.

See the full report here: https://www.bleepingcomputer.com/news/security/cloned-atomic-wallet-website-is-pushing-mars-stealer-malware/

A new type of cryptomining attack aims to hijack network bandwidth

Unlike the “old school” cryptominers that cause a dramatic increase in CPU consumption, the “new” cryptominer causes only moderate increase in CPU cycles. This technique lets the new cryptominer stay under the radar.

See the full report here: https://www.scmagazine.com/news/cloud-security/a-new-type-of-cryptomining-attack-aims-to-hijack-network-bandwidth

School kid uploads ransomware scripts to PyPI repository as 'Fun' Project

An apparently school-age hacker based in Verona, Italy, recently uploaded multiple malicious Python packages containing ransomware scripts to the Python Package Index (PyPI), supposedly as a fun experiment.

See the full report here: https://www.darkreading.com/threat-intelligence/school-kid-uploads-ransomware-scripts-to-pypi-repository-as-fun-research-project

VirusTotal Reveals Most Impersonated Software in Malware Attacks

Skype, Adobe Reader, and VLC Player are reportedly the most impersonated apps used by threat actors. Other highly impersonated brands (by icon) include 7-Zip, TeamViewer, CCleaner, Microsoft Edge, Steam, Zoom, and WhatsApp.

See the full report here: https://thehackernews.com/2022/08/virustotal-reveals-most-impersonated.html

Russian organizations attacked with new Woody RAT malware

Unknown attackers are targeting Russian entities (including a aerospace and defense entity OAK) with newly discovered malware called Woody Rat. It allows the attackers to control and steal information from compromised devices remotely.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-organizations-attacked-with-new-woody-rat-malware/

Cisco fixes critical remote code execution bug in VPN routers

Cisco has fixed critical security bugs (CVE-2022-20842 and CVE-2022-20827) in the web-based management interfaces and the web filter database update feature, both of which both caused by insufficient input validation. Cisco has released software updates to address both vulnerabilities and says there are no workarounds to remove the attack vectors.

See the full report here: bleepingcomputer.com/news/security/cisco-fixes-critical-remote-code-execution-bug-in-vpn-routers/

Ukraine takes down 1,000,000 bots used for disinformation

The Ukrainian cyber police (SSU) has shut down a massive bot farm of 1,000,000 bots used to spread disinformation on social networks. The messages spread by the bots were in line with Russian propaganda, so the operators of the disinformation machine are believed to be members of the Russian special services.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraine-takes-down-1-000-000-bots-used-for-disinformation/

Researchers Warns of Large-Scale AiTM Attacks Targeting Enterprise Users

A new, large-scale phishing campaign is using adversary-in-the-middle (AitM) techniques to get around security protections and compromise enterprise email accounts. It uses an adversary-in-the-middle (AitM) attack technique capable of bypassing multi-factor authentication.

See the full report here: https://thehackernews.com/2022/08/researchers-warns-of-large-scale-aitm.html

Single-Core CPU Cracked Post-Quantum Encryption Candidate Algorithm in Just an Hour

A late-stage candidate encryption algorithm (SIKE — Supersingular Isogeny Key Encapsulation) that was meant to withstand decryption by powerful quantum computers in the future has been cracked via a computer running Intel Xeon CPU in an hour's time.

See the full report here: https://thehackernews.com/2022/08/single-core-cpu-cracked-post-quantum.html

Taiwan defence ministry: Website hit by cyber attacks amid China tensions

Taiwan defence ministry reported that its website suffered cyber attacks and went offline temporarily, as tensions with China rise. Earlier this week, several government websites, including the presidential office, were subject to overseas cyber attacks.

See the full report here: https://www.reuters.com/world/asia-pacific/taiwan-defence-ministry-website-hit-by-cyber-attacks-amid-china-tensions-2022-08-04/

Over 280M records comprising UANs, bank account info and PII leaked online

A routine search for public exposures on the internet revealed two IPs containing massive amounts of highly sensitive data belonging to Indian citizens. the compromised data included names and addresses, Universal Account Numbers (UANs), bank account numbers along with IFSC codes, Aadhaar card numbers, employment details, income slabs, marital status, and guardians’ names, among others.

See the full report here: https://ciso.economictimes.indiatimes.com/news/breaking-over-280m-records-including-uan-bank-account-info-and-pii-leaked-online/93333754