Keeping One Step Ahead of Black Friday Cyber Threats
Threat Intelligence / ShadowTalk Update – Microsoft Teams ATO Vulnerability, APT32, & Uptick In Ransomware

ShadowTalk Update – Microsoft Teams ATO Vulnerability, APT32, & Uptick In Ransomware

ShadowTalk Update – Microsoft Teams ATO Vulnerability, APT32, & Uptick In Ransomware
Digital Shadows Analyst Team
Read More From Digital Shadows Analyst Team
May 1, 2020 | 3 Min Read

Jamie, Adam, and Demelza join Viktoria for this week’s threat intelligence updates.

Top stories this week include:
– Vulnerability allowed hijacking of Microsoft Teams account with a GIF
– APT32 seeks pandemic intel from Wuhan government, Chinese ministry
– Microsoft Intelligence team report on uptick in ransomware

Listen to this week’s episode now 👇

25,000plus leaked credentials of health entities posted online

On 22 Apr 2020 security researchers reported that more than 25,000 email addresses and passwords had been posted online. The leaked credentials were allegedly linked to accounts associated with health-related entities: the World Health Organization, the Bill & Melinda Gates Foundation, the United States’ National Institutes of Health and Centers for Disease Control and Prevention, the World Bank, and the PRC’s Wuhan Institute of Virology. It is realistically possible that activists and threat actors will continue to target health organizations for sensitive information in the short-term future, as the COVID-19 pandemic continues. 

Syrian government surveils citizens through Android apps

On 15 Apr 2020 security researchers reported that a Syrian state-associated threat actor has been conducting a domestic surveillance campaign using malicious Android apps. The campaign reportedly began in January 2018 and is targeting Arabic speakers; identified package names contained several references to Syria, likely indicating a domestic surveillance operation. Seventy-one malicious apps were connected to a single C2 server, which is owned by the government-affiliated Syrian Telecommunications Establishment (STE); STE is known to have hosted infrastructure for the Syrian Electronic Army. None of the apps were available on the Google Play Store, which indicates that they were offered by a third-party service.

Cybercriminals steal USD 25 million in assets from cryptocurrency platforms 

On 19 Apr 2020 security researchers reported that unnamed threat actors had exploited two cryptocurrency platforms, and Uniswapstealing USD 25 million worth of cryptocurrency assets. The attackers took advantage of a reentrancy vulnerability that affected both platforms and allowed them to recursively call back a withdraw function. Cryptocurrency remains an attractive target for cybercriminals, and such attacks are likely to continue in the mid-term future. 

For more details, read the full Weekly Intelligence Summary:

Weekly Intelligence Summary 01 May 2020

Related Blog Posts

Dark Web Recruitment: Malware, Phishing, and Carding

Dark Web Recruitment: Malware, Phishing, and Carding

November 10, 2022 | 12 Min Read

In our first blog in this series, we covered how...
2023 Cyber Threat Predictions

2023 Cyber Threat Predictions

November 1, 2022 | 14 Min Read

As we move towards the end of 2022, now is the...
Q3 2022 Vulnerability Roundup

Q3 2022 Vulnerability Roundup

October 26, 2022 | 5 Min Read

The curtain has fallen on the third quarter (Q3)...