Roses are red, violets are blue, here’s our threat intel podcast, just for you!
Kacey, Charles, Alex, and Harrison have a Valentine’s special for you all. This week the team covers:
– OurMine hacks
– The Equifax Indictment
– SWIFT POC attack
Listen below 👇👇👇
Malaysian government officials targeted in espionage campaign
The Malaysian Computer Emergency Response Team (MyCERT) released an advisory on 05 Feb 2020, stating that Malaysian government officials had been targeted in an espionage campaign. According to MyCERT, the attackers pretended to be a journalist, an individual from a trade publication, and representatives for a military organization and a non-governmental organization (NGO), to deliver spearphishing emails containing malicious documents. MyCERT did not directly attribute the attack, although the advisory included links to research from the cyber security community describing the tools and modus operandi of the China-linked threat group “APT40”.
Citrix systems of affected companies remain unpatched
Security researchers reported that 19 percent of the around 800,000 companies affected by the critical vulnerability in the Citrix Application Delivery Controller and Citrix Gateway (CVE-2019-19781) have not yet patched their systems. Since the vulnerability was disclosed in December 2019, CVE-2019-19781 has been actively exploited by multiple threat actors. It is highly likely that threat actors are still targeting vulnerable devices, and organizations using the affected products should patch their systems as soon as possible.
Proof of concept for fraudulent SWIFT payment demonstration released
On 07 Feb 2020, a security researcher released a proof-of-concept (PoC) demonstration for a fraudulent SWIFT payment transaction. In the PoC, the researcher was able to move funds from one account to another by manually forging a raw SWIFTMT103 payment message. Throughout the process, the researcher did not exploit any vulnerabilities within the target system; legitimate user access was leveraged in tandem with the trust relationships that exist by design within the large-scale payment processing systems.
For more details, read the full Weekly Intelligence Summary
And to stay up to date with the latest from Digital Shadows (now ReliaQuest), subscribe below.