Roses are red, violets are blue, here’s our threat intel podcast, just for you!

Kacey, Charles, Alex, and Harrison have a Valentine’s special for you all. This week the team covers:
– OurMine hacks
– The Equifax Indictment
– SWIFT POC attack

Listen below 👇👇👇

 

Malaysian government officials targeted in espionage campaign

The Malaysian Computer Emergency Response Team (MyCERT) released an advisory on 05 Feb 2020, stating that Malaysian government officials had been targeted in an espionage campaign. According to MyCERT, the attackers pretended to be a journalist, an individual from a trade publication, and representatives for a military organization and a non-governmental organization (NGO), to deliver spearphishing emails containing malicious documents. MyCERT did not directly attribute the attack, although the advisory included links to research from the cyber security community describing the tools and modus operandi of the China-linked threat group “APT40”.

 

Citrix systems of affected companies remain unpatched

Security researchers reported that 19 percent of the around 800,000 companies affected by the critical vulnerability in the Citrix Application Delivery Controller and Citrix Gateway (CVE-2019-19781) have not yet patched their systems. Since the vulnerability was disclosed in December 2019, CVE-2019-19781 has been actively exploited by multiple threat actors. It is highly likely that threat actors are still targeting vulnerable devices, and organizations using the affected products should patch their systems as soon as possible.

 

Proof of concept for fraudulent SWIFT payment demonstration released

On 07 Feb 2020, a security researcher released a proof-of-concept (PoC) demonstration for a fraudulent SWIFT payment transaction. In the PoC, the researcher was able to move funds from one account to another by manually forging a raw SWIFTMT103 payment message. Throughout the process, the researcher did not exploit any vulnerabilities within the target system; legitimate user access was leveraged in tandem with the trust relationships that exist by design within the large-scale payment processing systems.

 

For more details, read the full Weekly Intelligence Summary

Weekly Intelligence Summary 14 Feb 2020

And to stay up to date with the latest from Digital Shadows (now ReliaQuest), subscribe below.