Weekly News Roundup — March 10 to 16

Summary

— Hello, and welcome to Security Soup’s continuing news coverage of highlights from the previous week. This list is not intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly research. The summaries are provided with links for the reader to drill down into particular topics according to their own interests.

Industry News and Reports

F5 Networks to acquire NGINX
- https://www.f5.com/company/news/press-releases/f5-acquires-nginx-to-bridge-netops-devops
Avast: Global PC Risk Report 2019
- https://cdn2.hubspot.net/hubfs/486579/avast_2019_global_risk_report.pdf
Carbon Black: 2019 Cyberattack Landscape in Canada (email registration required for access)
- https://www.carbonblack.com/resources/threat-research/global-threat-report-series/
ISACA: State of Cybersecurity 2019
- https://cybersecurity.isaca.org/state-of-cybersecurity
Spam and phishing in 2018
- https://securelist.com/spam-and-phishing-in-2018/89701/

Tools and Tips

Adapting Cuckoo SandBox to the cloud on AWS
- https://research.checkpoint.com/cuckoo-system-on-aws/
PE-sieve updated to v 0.2
- https://github.com/hasherezade/hollows_hunter/releases/tag/v0.2
“More DFIR With Less Time”
- https://medium.com/@forensic_matt/more-dfir-with-less-time-b7410644c4e2
Intro to Cutter for Malware Analysis
- https://malwology.com/2019/03/14/intro-to-cutter-for-malware-analysis/amp/?__twitter_impression=true
ATOMIC: Clustering attacker activity at scale
- https://www.fireeye.com/blog/threat-research/2019/03/clustering-and-associating-attacker-activity-at-scale.html
BHIS Webcast: Tracking attackers. Why attribution matters and how to do it.
- https://www.blackhillsinfosec.com/bhis-webcast-tracking-attackers-why-attribution-matters-and-how-to-do-it/
DLL Hijacking & Ghidra
- https://liberty-shell.com/sec/2019/03/12/dll-hijacking/

Threats in the Wild – Malware, Phishing, and other campaigns

Recent GandCrab ransomware distributions leverage a fake CDC flue warning
- https://www.tripwire.com/state-of-security/security-data-protection/attackers-sending-out-fake-cdc-flu-warnings-to-distribute-gandcrab/
Malwarebytes revisits the Emotet threat
- https://blog.malwarebytes.com/cybercrime/2019/03/emotet-revisited-this-pervasive-persistent-threat-is-still-a-danger-to-businesses/
Nymaim config decoded
- https://www.proofpoint.com/us/threat-insight/post/nymaim-config-decoded
MFA bypass for cloud accounts via phishing and credential dumps
- https://www.proofpoint.com/us/threat-insight/post/threat-actors-leverage-credential-dumps-phishing-and-legacy-email-protocols
“Powload” technique evolution from fileless to steganography
- https://blog.trendmicro.com/trendlabs-security-intelligence/from-fileless-techniques-to-using-steganography-examining-powloads-evolution/
Remote Access Trojans (RATs) and corporate risk
- https://www.recordedfuture.com/rat-corporate-risk-assessment/
An analysis of new Emotet spreader modules
- https://www.fortinet.com/blog/threat-research/analysis-of-the-new-modules-that-emotet-spreads.html
“Uncomfortable Truth” series about Phishing Defense
- https://cofense.com/uncomfortable-truth-1-phishing-defense/
- https://cofense.com/uncomfortable-truth-2-phishing-defense/
Not just for BEC: A look at email threadjacking to spread malware
- https://blog.minerva-labs.com/attackers-insert-themselves-into-the-email-conversation-to-spread-malware
Check Point: February 2019’s Most Wanted Malware
- https://blog.checkpoint.com/2019/03/11/february-2019s-most-wanted-malware-coinhive-quits-gandcrab-cryptomining-ransomware/
A look at enhance stealer features for new Ursnif variants
- https://www.cybereason.com/blog/new-ursnif-variant-turns-to-cryptocurrency-as-banks-become-more-secure
PsMiner: a new Go-based mining worm
- https://blog.360totalsecurity.com/en/new-mining-worm-psminer-uses-multiple-high-risk-vulnerabilities-to-spread/

Vulnerabilities and Exploits

Cross-site scripting (XSS) vulnerability in shopping cart plugin leads to WordPress compromises
- https://www.wordfence.com/blog/2019/03/xss-flaw-in-abandoned-cart-plugin-leads-to-wordpress-site-takeovers/
An unpatched Windows flaw could allow an attacker to spoof security dialog boxes
- https://threatpost.com/windows-bug-spoof-dialog-boxes/142711/

Breaches, Government, and Law Enforcement

Citrix discloses an unauthorized access to its network
- https://www.citrix.com/blogs/2019/03/08/citrix-investigating-unauthorized-access-to-internal-network/
Delaware Guidance Services pays ransom to criminals
- https://www.scmagazine.com/home/security-news/ransomware-attack-pays-off-as-delaware-guidance-services-gives-in-to-criminals/
Several companies apparently leaked sensitive data from misconfigured Box accounts
- https://techcrunch.com/2019/03/11/data-leak-box-accounts/
- https://www.adversis.io/research/pandorasbox
Ohio introduces Data Protection Act
- https://www.cpomagazine.com/data-protection/the-ohio-data-protection-act-and-the-quiet-revolution/
Russian regime temporarily blocked access to ProtonMail
- https://www.theregister.co.uk/2019/03/12/protonmail_blocked_russia_fsb/
U.S. bill for ‘IoT’ security standards
- https://thehill.com/policy/cybersecurity/433519-lawmakers-introduce-bipartisan-bill-to-set-security-standards-for