October 31 2024 – Cyber Briefing

👉 What’s going on in the cyber world today?

FakeCall Malware, Android, Hijacks Calls, Malicious Python Tool, CryptoAITools, Trading Bot, Steal Cryptocurrency, Meta Ads, SYS01stealer, LightSpy, Destructive Plugins, iOS Users, Opera Browser, Security Flaw, Private APIs, Colorado Voting Systems, Israeli Businesses, Credit Card Payment Processing, EmeraldWhale Campaign, Cloud Credentials, Western Sydney University, Cybersecurity, Financial Services, India, Cyberattacks Surge, UnitedHealth, New CISO, Valve, Kernel-Level Anti-Cheat Software, Albany ENT and Allergy Services

Listen to the full podcast

🚨 Cyber Alerts

1. Android FakeCall Malware Hijacks Bank Calls

The latest version of FakeCall malware on Android, analyzed by Zimperium, intercepts and redirects calls to financial institutions, routing them to attackers instead. This updated banking trojan now impersonates over 20 financial organizations and can live-stream device screens, capture sensitive data, and manipulate outgoing calls, making it difficult for victims to detect the deception. Zimperium warns that FakeCall continues to evolve with enhanced evasion techniques, adding new functionalities to increase its effectiveness in stealing personal and financial information from unsuspecting users worldwide.

2. CryptoAITools Malware Hits Crypto Wallets

Researchers have uncovered “CryptoAITools,” a malicious Python package posing as a cryptocurrency trading tool that covertly steals sensitive information and assets from victims’ crypto wallets. Distributed via PyPI and GitHub, the malware reached over 1,300 downloads before removal from PyPI. Using a deceptive graphical interface, it distracts users on both Windows and macOS systems while performing data theft and draining wallets. With a multi-platform approach, this campaign threatens a broad array of cryptocurrency users globally, heightening risks for anyone engaging with its code or related repositories.

3. Meta Exploited by SYS01stealer Malware

Cybersecurity researchers have identified an ongoing malvertising campaign abusing Meta’s advertising platform to spread the SYS01stealer malware. This campaign utilizes trusted brands and nearly a hundred malicious domains, allowing hackers to manage their attacks in real-time. The malware targets Facebook business accounts to steal sensitive data, including login credentials and browsing history, while repurposing hijacked accounts to amplify the campaign’s reach.

4. LightSpy Malware Gains New Destructive Power

A new version of LightSpy malware for iOS has emerged, featuring 28 plugins that enhance its destructive capabilities. Discovered by ThreatFabric, this malware exploits known vulnerabilities to gain access to devices and steal sensitive data, including messages and browsing history. The updated malware can now even prevent devices from booting and erase evidence of the attack, highlighting the growing sophistication of these state-sponsored cybercriminals.

5. Opera Browser Flaw Enabled Access to APIs

A newly patched security flaw in the Opera web browser, known as CrossBarking, could have let malicious extensions gain unauthorized access to private APIs. According to Guardio Labs, this vulnerability enabled actions such as capturing screenshots, modifying settings, and hijacking accounts. Although Opera has addressed the issue, the incident highlights ongoing challenges in balancing productivity with security in browser extensions, underscoring the need for improved oversight and monitoring of add-ons.

💥 Cyber Incidents

6. Exposed Voting System Passwords in Colorado

Voting system passwords were inadvertently posted on the Colorado Secretary of State’s website for several months before their removal, yet officials stated that this lapse does not present an immediate threat to the upcoming election. The passwords, which are part of a two-password system necessary to access the voting components, are stored separately and controlled by different parties, as explained by Jack Todd, a spokesperson for the Secretary of State’s office. Colorado Secretary of State Jena Griswold reassured the public that her office is investigating the incident, updating passwords, and reviewing access logs, asserting that no security breach has occurred.

7. Interbank Data Breach Exposes Customer Info

Interbank, one of Peru’s major financial institutions, has confirmed a significant data breach after a threat actor hacked into its systems and leaked sensitive customer data online. The attacker, identified by the handle “kzoldyck,” claims to have stolen extensive personal and financial information from over 3 million customers, including names, account IDs, and credit card details. Following the incident, Interbank assured clients that their deposits remain secure and that the bank has implemented additional security measures to protect customer information and operations.

8. Israeli Credit Card Payments Disrupted

A cyberattack affected credit card payments for Israeli businesses on Tuesday morning, causing significant disruptions according to Shva Automatic Bank Services. The denial-of-service attack began around 7 a.m. and interrupted transaction processing, but services were restored by 9:50 a.m. Shva, which is the largest provider of communication and IT services for Israel’s banking sector, did not specify the attack’s source, although speculation points to the group “Anonymous Sudan” known for targeting Israel previously.

9. EmeraldWhale Operation Steals Credentials

A recent cyber operation known as “EmeraldWhale” has targeted exposed Git configuration files, leading to the theft of more than 15,000 cloud account credentials from thousands of private repositories. Sysdig, the cybersecurity firm that discovered the operation, reported that automated tools scanned IP ranges for Git configuration files, which often contain authentication tokens. These tokens were exploited to download repositories from platforms such as GitHub, GitLab, and BitBucket, allowing attackers to scan for further credentials and exfiltrate sensitive data.

10. Western Sydney University Cyber Attack

Western Sydney University in Australia has reported a cyber attack that compromised personal data after a threat actor accessed an IT account, allowing them to exfiltrate data from its Student Management System. Discovered nearly two weeks after the initial breach on August 14, the university confirmed that sensitive information, including names, addresses, and academic records, was accessed. The university is actively bolstering its cybersecurity measures and working with authorities to mitigate future risks and notify affected individuals.

📢 Cyber News

11. ATPC Council Hosts Cybersecurity Dialogue

On October 31, 2024, the American Transaction Processors Coalition Cyber Council will host an event titled “The Tie that Binds: A 21st Century Cybersecurity Dialogue” at the Bank of America Financial Center Tower in Atlanta. The gathering will bring together top cyber experts from the financial services sector, federal agencies, and Congress to address critical cybersecurity issues and strategies for the future. Discussions will cover evolving technologies, the role of artificial intelligence, and necessary supply chain security measures, all aimed at fortifying the financial services sector against emerging threats.

12. India Faces Rising Cyberattack Threats

India faces a concerning projection of cyberattacks escalating to a staggering $1 trillion annually by 2033 and potentially reaching $17 trillion by 2047, according to a study by PRAHAR, a nonprofit organization. This trend threatens the nation’s rise as a global power, with adversaries launching coordinated efforts to undermine its growth from both internal and external sources. The report highlights a sharp increase in cyber threats, with over 79 million cyberattacks recorded in 2023 and a further escalation leading to the blocking of over 500 million incidents in the first quarter of 2024.

13. UnitedHealth Hires New Cybersecurity Chief

UnitedHealth Group has appointed Tim McKnight as its new Chief Information Security Officer following a ransomware attack on its subsidiary, Change Healthcare, which caused significant disruptions in the medical industry. McKnight brings extensive experience to the role, having previously worked in cybersecurity positions at major companies, including Northrop Grumman, Fidelity, and General Electric, after serving as an FBI agent for eight years. His hiring comes amid scrutiny of UnitedHealth’s cybersecurity measures and previous leadership decisions that were criticized during a Congressional hearing, particularly regarding the qualifications of the former CISO, Steven Martin.

14. Valve Mandates Anti-Cheat Disclosure

Valve has announced a significant change regarding the disclosure of kernel-level anti-cheat systems in games distributed through its Steam platform. This requirement aims to enhance transparency for players, as many have expressed concerns about the potential security risks associated with highly privileged kernel access. Going forward, game developers must indicate whether their games install client-side kernel mode anti-cheat systems, with this information prominently displayed on the Steam Store.

15. Albany ENT Settles for Data Breach Security

Albany ENT & Allergy Services in Albany, New York has agreed to a $500,000 settlement and a commitment to invest $2.25 million in a cybersecurity program following two significant patient data breaches. These breaches, initially reported in April 2023, involved unauthorized access to sensitive patient information, including social security numbers and driver’s license details. The breaches were linked to the RansomHouse and BianLian ransomware groups, although the organization’s notification to affected individuals did not mention the ransomware incidents or the extent of the data compromised.