SHADOWTALK UPDATE – WANNACRY ANNIVERSARY, WORDPRESS PLUGIN VULNERABILITY, AND WELEAKDATA COMPROMISED

SHADOWTALK UPDATE – WANNACRY ANNIVERSARY, WORDPRESS PLUGIN VULNERABILITY, AND WELEAKDATA COMPROMISED
Digital Shadows Analyst Team
Read More From Digital Shadows Analyst Team
May 18, 2020 | 2 Min Read

The team starts this week’s episode with a retrospective look at WannaCry, discussing some core lessons learned from this ransomware attack. Viktoria, Demelza, Adam, and Jamie then dig through other top stories including:

  • A wordpress plugin vulnerability
  • WeLeakData[.]com compromised with the hackers’ messages leaked
  • BitBazaar Dark Web Market deception and manipulation

ShinyHunters offers 73 million user records on dark web

On 09 May 2020 it was reported that a hacker group by the name of ShinyHunters was using underground marketplaces to advertise for sale 73 million-plus user records from more than ten companies. Databases that contained the user records were stolen from the online dating app Zoosk, the United States newspaper Star Tribune, and the Indonesian online store Bhinneka, among other entities. Each database was offered on the dark-web marketplaces for approximately USD 18,000. Three days prior, ShinyHunters claimed to have stolen over 500GB of data from Microsoft’s private GitHub repositories.

Businesses twice unlucky in ransomware attacks

Amid consistent reporting of ransomware attacks, two organizations have reportedly become victims twice, in apparently unrelated attacks. Australian shipping company Toll Group was affected by the “Nefilim” ransomware; their first ransomware attack involved the “MailTo” variant in February 2020. The other company, United States-based global shipping and e-commerce solutions provider Pitney Bowes, was targeted with the “Maze” ransomware and had previously been affected by the “Ryuk” ransomware in October 2019.

Zeus Sphinx trojan upgraded even as phishing attacks persist

On 11 May 2020 researchers reported that the “Zeus Sphinx” banking trojan had been receiving frequent updates and upgrades while being deployed in phishing email campaigns. The email messages contained information purportedly related to COVID-19 relief payments. Upgrades extended to the trojan’s persistence mechanisms, browser injection tactics, and naming algorithms. Apart from campaigns using COVID-19 themes, Zeus Sphinx has also been used in attacks targeting banks.

For more details, read the full Weekly Intelligence Summary:

Weekly Intelligence Summary 15 May 2020

Related Posts

3 Phishing Trends Organizations Should Watch Out For

3 Phishing Trends Organizations Should Watch Out For

May 20, 2020 | 16 Min Read

It’s only May, and is it just me, or has this...
The 2020 Verizon Data Breach Investigations Report: One CISO’s View

The 2020 Verizon Data Breach Investigations Report: One CISO’s View

May 19, 2020 | 6 Min Read

Sadly, Marvel’s Black Widow release date was...
A NEW DECADE OF CYBER THREATS: LOOKING BACK AT THE TRENDING CYBER TOPICS OF Q1 2020

A NEW DECADE OF CYBER THREATS: LOOKING BACK AT THE TRENDING CYBER TOPICS OF Q1 2020

May 14, 2020 | 10 Min Read

Q1 2020 was packed full of significant...
Contact Tracing: Can ‘Big Tech’ Come to the Rescue, and at What Cost?

Contact Tracing: Can ‘Big Tech’ Come to the Rescue, and at What Cost?

May 11, 2020 | 13 Min Read

Co-authored by: Pratik Sinha MD PhD1,2, Alastair...