News

A new modular and malware designed to target diplomatic and government entities was spotted by ESET researchers while being utilized in attacks aimed at Russian-speaking individuals for at least 7 years. The espionage malware strain dubbed Attor by the researchers comes with some unusual capabilities including the use of encrypted modules, Tor-based communications, and a plugin designed for GSM fingerprinting using the AT protocol. Source: Bleeping Computer

Popular prostitution and escort forums in the Netherlands and Italy have suffered data breaches that exposed the usernames, email addresses, and hashed passwords for their registered members. With prostitution and escort services being legal in the Netherlands and Italy, forums have been created that allows users to review services or interact directly with sex workers. Source: Bleeping Computer

29-year old Singapore citizen Ho Jun Jia aka Matthew Ho was charged today under a 14-count indictment for allegedly mining cryptocurrency using stolen Amazon AWS and Google Cloud computing power and services. The defendant who was taken into custody by the Singapore Police Force on September 26, used the credit card and identity information stolen from California and Texas residents to run a large-scale cryptocurrency mining operation. Source: Bleeping Computer

The medical and personal information of about 1 million people was exposed after a breach of Tū Ora Compass Health, a primary health organization (PHO) located in New Zealand. The non-governmental organization (NGO) discovered four intrusions – by what Ministry of Health Director-General of Health Ashley Bloomfield said were two hacktivists and two “more sophisticated actors” – on August 5 after its website was defaced. Source: SC Magazine

Community-based healthcare system Methodist Hospitals from Gary, Indiana, disclosed that sensitive personal and medical information for 68,039 individuals may have been exposed following a successful phishing attack against two of its employees. Methodist provides surgical and medical hospital services, it employs 2,576 individuals, and it reported a total number of 195,055 patient encounters during 2018 according to last year's annual report. Source: Bleeping Computer

Email addresses and phone numbers provided to secure user accounts were accidentally shared with marketers. Twitter account holders who provided an email address or phone number to enable multifactor authentication may have had their data used for advertising purposes, Twitter reports. Source: Dark Reading

The official Sesame Street online store, along with thousands of other retailers, has been targeted by a credit card-stealing hack. Card details were collected by a piece of malicious software, dubbed JavaScript Cookie. The code was found in shopping cart software built by Volusion, which has 20,000 small business customers. The issue was spotted by a security researcher while shopping for toys on the Sesame Street store. Source: BBC News

Political parties and election systems will be heavily targeted in the months leading up to the 2020 general elections, some security experts say. A recently detected Iranian cyberattack targeting a US presidential campaign may well be a harbinger of what's in store for political parties and election systems in the run-up to next year's general elections. Source: Dark Reading

Hackers may have absconded with tens of thousands of online shoppers' credit card information in an attack on cloud infrastructure company, Volusion. According to ZDNet, multiple cyber security firms have confirmed the hack on Volusion, a software company that claims to provide infrastructure for more than 30,000 merchants. Among the affected parties are the Sesame Street Live online store which sells various merchandise from the popular kids show and the official website for the late painting...

A new Mimecast report finds a significant uptick in BEC attacks, malware attachments, and spam landing in target inboxes. Business email compromise (BEC) ramped up 269% from last quarter to this quarter, according to Mimecast's latest Email Security Risk Assessment (ESRA). This quarter showed a massive spike in emails containing dangerous file types, malware attachments, and spam in target inboxes. Source: Dark Reading