SHADOWTALK UPDATE – WANNACRY ANNIVERSARY, WORDPRESS PLUGIN VULNERABILITY, AND WELEAKDATA COMPROMISED

SHADOWTALK UPDATE – WANNACRY ANNIVERSARY, WORDPRESS PLUGIN VULNERABILITY, AND WELEAKDATA COMPROMISED
Digital Shadows Analyst Team
Read More From Digital Shadows Analyst Team
May 18, 2020 | 2 Min Read

The team starts this week’s episode with a retrospective look at WannaCry, discussing some core lessons learned from this ransomware attack. Viktoria, Demelza, Adam, and Jamie then dig through other top stories including:

  • A wordpress plugin vulnerability
  • WeLeakData[.]com compromised with the hackers’ messages leaked
  • BitBazaar Dark Web Market deception and manipulation

ShinyHunters offers 73 million user records on dark web

On 09 May 2020 it was reported that a hacker group by the name of ShinyHunters was using underground marketplaces to advertise for sale 73 million-plus user records from more than ten companies. Databases that contained the user records were stolen from the online dating app Zoosk, the United States newspaper Star Tribune, and the Indonesian online store Bhinneka, among other entities. Each database was offered on the dark-web marketplaces for approximately USD 18,000. Three days prior, ShinyHunters claimed to have stolen over 500GB of data from Microsoft’s private GitHub repositories.

Businesses twice unlucky in ransomware attacks

Amid consistent reporting of ransomware attacks, two organizations have reportedly become victims twice, in apparently unrelated attacks. Australian shipping company Toll Group was affected by the “Nefilim” ransomware; their first ransomware attack involved the “MailTo” variant in February 2020. The other company, United States-based global shipping and e-commerce solutions provider Pitney Bowes, was targeted with the “Maze” ransomware and had previously been affected by the “Ryuk” ransomware in October 2019.

Zeus Sphinx trojan upgraded even as phishing attacks persist

On 11 May 2020 researchers reported that the “Zeus Sphinx” banking trojan had been receiving frequent updates and upgrades while being deployed in phishing email campaigns. The email messages contained information purportedly related to COVID-19 relief payments. Upgrades extended to the trojan’s persistence mechanisms, browser injection tactics, and naming algorithms. Apart from campaigns using COVID-19 themes, Zeus Sphinx has also been used in attacks targeting banks.

For more details, read the full Weekly Intelligence Summary:

Weekly Intelligence Summary 15 May 2020

Access Our Threat Intel In Test Drive

Test Drive SearchLight Free for 7 Days
Try It Now

Connect with us

Related Posts

It’s even easier to initiate takedowns in SearchLight

It’s even easier to initiate takedowns in SearchLight

August 12, 2020 | 3 Min Read

When faced with infringing content, phishing...
Escrow systems on cybercriminal forums: The Good, the Bad and the Ugly

Escrow systems on cybercriminal forums: The Good, the Bad and the Ugly

August 11, 2020 | 15 Min Read

Just a few short months ago, the...
Saving the SOC from overload by operationalizing digital risk protection

Saving the SOC from overload by operationalizing digital risk protection

August 5, 2020 | 4 Min Read

As you may have seen last week, the latest...