This Week in Security News - Jan. 29, 2021
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days.
Save to Folio
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about how a global police investigation has culminated in Emotet's takedown and the arrest of multiple alleged members behind it. Also, read about an evolving phishing campaign that has been targeting high-ranking company executives since May 2020.
Read on:
Low Powered but High Risk: Evaluating Possible Attacks on LoRaWAN Devices
Long Range Wide Area Network (LoRaWAN) devices have been hacking targets for quite some time. In this blog, Trend Micro outlines the attacks that malicious actors can use against vulnerable LoRaWAN devices and reviews the state of LoRaWAN security. This is the first blog of a three-part series.
Parents Say ‘Yes’ To Screen Time During the Pandemic
Nearly every parent claims to want to cut down on their kids’ screen time, but many of them seem to be sick of hearing about how electronics are ruining their children during the pandemic. In this article, learn why Lynette Owens, founder and global director of Trend Micro’s Internet Safety for Kids and Families program, is not concerned about screen time that benefits children’s physical well-being, supports them as learners or nurtures their relationships with family and friends.
Sodinokibi was first detected in April 2019 and was linked to the retired GandCrab. From that point on, Sodinokibi launched several high-profile attacks that continued throughout 2020, thus making a name for itself as one of the ransomware families that should be closely monitored. In this blog, Trend Micro describes Sodinokibi’s typical attack process.
Cops Disrupt Emotet, the Internet's ‘Most Dangerous Malware’
For more than half a decade, the malware known as Emotet has menaced the internet, growing into one of the largest botnets in the world and targeting victims with data theft and crippling ransomware. Now a sprawling, global police investigation has culminated in Emotet's takedown and the arrest of multiple alleged members of the criminal conspiracy behind it.
Fake Office 365 Used for Phishing Attacks on C-Suite Targets
Trend Micro has been following an evolving phishing campaign that targets high-ranking company executives since May 2020. The attackers reuse compromised hosts for the phishing pages targeting organizations in manufacturing, real estate, finance, government, and technology industries in several countries such as Japan, the U.S., UK, Canada, Australia and Europe. Trend Micro has found over 300 unique compromised URLs and 70 email addresses from eight compromised sites.
Phishing Scheme Shows CEOs May be ‘Most Valuable Asset,’ and ‘Greatest Vulnerability’
Researchers from Trend Micro reported that they uncovered 70 email addresses that have been targeted with the so-called “Office 365 V4 phishing kit,” 40 of which belong to CEOs, directors, owners and founders among other enterprise employee[s]. Ryan Flores, senior manager of forward-looking threat research in the APAC region at Trend Micro, shares more information on the attack with SC Media.
Apple Patches Three Actively Exploited Zero-Days, Part of iOS Emergency Update
Apple continues to put out potential security fires by patching zero-day vulnerabilities, releasing an emergency update this week to patch three more recently discovered in iOS after a major software update in November already fixed three that were being actively exploited.
A Look at Linux: Threats, Risks and Recommendations
Like any software, Linux is not free from security-related threats and risks. As enterprises migrate to the cloud and Linux, it comes as no surprise that cybercriminals would shift their focus and resources to target these environments. This new research from Trend Micro discusses the Linux threat landscape and examines how Linux has become an attractive target for attackers, as well as how it can be prone to a variety of threats and risks.
Cybercriminals Kick-Off 2021 with Sweepstakes, Credit Card, Delivery Scams
In this blog, learn about the behaviors and external indicators of phishing campaigns that Trend Micro has observed from the latter part of December 2020 to the first weeks of January 2021. These campaigns highlight the inclusion of fake online payment forms with the goal of stealing financial information more efficiently.
Cyber Command, NSA Warn to Patch Decade-Old Sudo Vulnerability
U.S. intelligence officials are urging American companies and security workers to fix a software flaw that, if exploited, would give attackers deep access to a victim machine. The vulnerability, which now has a patch, would have allowed unauthorized users to gain what’s known as root privileges on vulnerable hosts as early as 2011 when the flaw was introduced. Root access would enable at hacker to obtain administrative privileges over a machine, and quietly collect sensitive information.
NHTSA Updates Cybersecurity Best Practice of Modern Vehicles
Positive changes are on the way for the cybersecurity concerns in the automotive industry. The National Highway and Traffic Safety Administration (NHTSA) has released an update to their Cybersecurity Best Practices for the Safety of Modern Vehicles. The 2020 update on the document was based on agency research, industry progress, and public comments received on the previous version.
Pwn2Own 2021: Hackers Offered $200,000 for Zoom, Microsoft Teams Exploits
Trend Micro’s Zero Day Initiative (ZDI) announced the targets, prizes and rules for the Pwn2Own Vancouver 2021 hacking competition, scheduled for April 6-8. The event typically takes place during the CanSecWest conference in Vancouver, Canada, but due to the coronavirus pandemic, this year’s event will be hybrid — participants can submit their exploits remotely and ZDI staff in Toronto (Canada) and Austin (Texas) will run the exploits. The attempts will be live streamed on YouTube and Twitch.
12 Tips to Help Keep Your Data Private
Each year, Data Privacy Day (or Data Protection Day) is honored on January 28th in the U.S., Canada, Israel and 47 European countries. Its purpose is to raise awareness and promote best practices for data privacy and protection in the digital age. In the weeks prior and after the anchor day, it’s good to take time to re-educate yourself on what you can do on a regular basis to help to keep your data private. Read this blog to learn some tips and tools on data privacy.
Post Office Phishing Hits Credit Card Users in 26 Countries
Trend Micro has been tracking a phishing campaign since last year, where campaign distributors attempt to steal people’s credit card number by sending phishing emails related to deliveries from national postal systems. This widespread attempt affects at least 26 countries, including the U.S., Switzerland, China, Japan, and Singapore. From December 1, 2020 to January 10, 2021, 279,308 suspicious post office phishing URLs (an average of 6,812 URLs per day) were detected by Trend Micro email products.
What do you think about the Emotet takedown? Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.