ShadowTalk Update – Microsoft Teams ATO Vulnerability, APT32, & Uptick In Ransomware

ShadowTalk Update – Microsoft Teams ATO Vulnerability, APT32, & Uptick In Ransomware
Digital Shadows Analyst Team
Read More From Digital Shadows Analyst Team
May 1, 2020 | 3 Min Read

Jamie, Adam, and Demelza join Viktoria for this week’s threat intelligence updates.

Top stories this week include:
– Vulnerability allowed hijacking of Microsoft Teams account with a GIF
– APT32 seeks pandemic intel from Wuhan government, Chinese ministry
– Microsoft Intelligence team report on uptick in ransomware

Listen to this week’s episode now 👇


25,000plus leaked credentials of health entities posted online

On 22 Apr 2020 security researchers reported that more than 25,000 email addresses and passwords had been posted online. The leaked credentials were allegedly linked to accounts associated with health-related entities: the World Health Organization, the Bill & Melinda Gates Foundation, the United States’ National Institutes of Health and Centers for Disease Control and Prevention, the World Bank, and the PRC’s Wuhan Institute of Virology. It is realistically possible that activists and threat actors will continue to target health organizations for sensitive information in the short-term future, as the COVID-19 pandemic continues. 


Syrian government surveils citizens through Android apps

On 15 Apr 2020 security researchers reported that a Syrian state-associated threat actor has been conducting a domestic surveillance campaign using malicious Android apps. The campaign reportedly began in January 2018 and is targeting Arabic speakers; identified package names contained several references to Syria, likely indicating a domestic surveillance operation. Seventy-one malicious apps were connected to a single C2 server, which is owned by the government-affiliated Syrian Telecommunications Establishment (STE); STE is known to have hosted infrastructure for the Syrian Electronic Army. None of the apps were available on the Google Play Store, which indicates that they were offered by a third-party service.


Cybercriminals steal USD 25 million in assets from cryptocurrency platforms 

On 19 Apr 2020 security researchers reported that unnamed threat actors had exploited two cryptocurrency platforms, Lendf.me and Uniswapstealing USD 25 million worth of cryptocurrency assets. The attackers took advantage of a reentrancy vulnerability that affected both platforms and allowed them to recursively call back a withdraw function. Cryptocurrency remains an attractive target for cybercriminals, and such attacks are likely to continue in the mid-term future. 


For more details, read the full Weekly Intelligence Summary:

Weekly Intelligence Summary 01 May 2020

Related Posts

3 Phishing Trends Organizations Should Watch Out For

3 Phishing Trends Organizations Should Watch Out For

May 20, 2020 | 16 Min Read

It’s only May, and is it just me, or has this...
The 2020 Verizon Data Breach Investigations Report: One CISO’s View

The 2020 Verizon Data Breach Investigations Report: One CISO’s View

May 19, 2020 | 6 Min Read

Sadly, Marvel’s Black Widow release date was...
A NEW DECADE OF CYBER THREATS: LOOKING BACK AT THE TRENDING CYBER TOPICS OF Q1 2020

A NEW DECADE OF CYBER THREATS: LOOKING BACK AT THE TRENDING CYBER TOPICS OF Q1 2020

May 14, 2020 | 10 Min Read

Q1 2020 was packed full of significant...