Jamie, Adam, and Demelza join Viktoria for this week’s threat intelligence updates.
Top stories this week include:
– Vulnerability allowed hijacking of Microsoft Teams account with a GIF
– APT32 seeks pandemic intel from Wuhan government, Chinese ministry
– Microsoft Intelligence team report on uptick in ransomware
Listen to this week’s episode now 👇
25,000-plus leaked credentials of health entities posted online
On 22 Apr 2020 security researchers reported that more than 25,000 email addresses and passwords had been posted online. The leaked credentials were allegedly linked to accounts associated with health-related entities: the World Health Organization, the Bill & Melinda Gates Foundation, the United States’ National Institutes of Health and Centers for Disease Control and Prevention, the World Bank, and the PRC’s Wuhan Institute of Virology. It is realistically possible that activists and threat actors will continue to target health organizations for sensitive information in the short-term future, as the COVID-19 pandemic continues.
Syrian government surveils citizens through Android apps
On 15 Apr 2020 security researchers reported that a Syrian state-associated threat actor has been conducting a domestic surveillance campaign using malicious Android apps. The campaign reportedly began in January 2018 and is targeting Arabic speakers; identified package names contained several references to Syria, likely indicating a domestic surveillance operation. Seventy-one malicious apps were connected to a single C2 server, which is owned by the government-affiliated Syrian Telecommunications Establishment (STE); STE is known to have hosted infrastructure for the Syrian Electronic Army. None of the apps were available on the Google Play Store, which indicates that they were offered by a third-party service.
Cybercriminals steal USD 25 million in assets from cryptocurrency platforms
On 19 Apr 2020 security researchers reported that unnamed threat actors had exploited two cryptocurrency platforms, Lendf.me and Uniswap, stealing USD 25 million worth of cryptocurrency assets. The attackers took advantage of a re–entrancy vulnerability that affected both platforms and allowed them to recursively call back a withdraw function. Cryptocurrency remains an attractive target for cybercriminals, and such attacks are likely to continue in the mid-term future.
For more details, read the full Weekly Intelligence Summary: