Alerts

[ALERT] ADVISORY ON DREAMBUS BOTNET

BACKGROUND

A new botnet named DreamBus is a malware with worm-like behavior that can propagate itself both across the Internet and literally through compromised internal networks using a variety of techniques. It installs the XMRig crypto miner on powerful enterprise-class Linux and Unix systems with the goal of using their computing power to Mine Monero cryptocurrency.

[ALERT] ADVISORY ON SUPPLY CHAIN ATTACK ON SOLARWINDS ORION PLATFORM SOFTWARE (SUNBURST BACKDOOR)

Background

FireEye has uncovered a widespread campaign, that they are tracking as UNC2452. The actors behind this campaign gained access to numerous public and private organizations around the world. They gained access to victims via trojanized updates to SolarWind’s Orion IT monitoring and management software. This incident may have begun as early as Spring 2020 and is currently ongoing. Post compromise activity following this supply chain compromise has included lateral movement and data theft.

[ALERT] ADVISORY ON ZERO-CLICK 'WORMABLE' RCE FLAW UNCOVERED IN MICROSOFT TEAMS

BACKGROUND

A Remote Code Execution vulnerability has been identified in MS Teams desktop app which can be triggered by a novel XSS (Cross-Site Scripting) injection in teams.microsoft.com. A specifically crafted chat message can be sent to any Microsoft Teams member or channel which will execute arbitrary code on a victim PC's with NO USER INTERACTION.

[ALERT] ADVISORY ON CISCO WEBEX VULNERABILITIES

BACKGROUND
Three high-severity security update patches for Cisco appliances have been released, which affects Webex Teams for Windows (CVE-2020-3535), its Identity Services Engine (CVE-2020-3467), and Video Surveillance 8000 Series IP Cameras (CVE-2020-3544).

IMPACT
CVE-2020-3467
Allow the attacker to modify parts of the configuration using authenticated user. The modified configuration could either allow unauthorized devices onto the network or prevent authorized devices from accessing the network

WhatsApp Spam Vulnerability

BACKGROUND

WhatsApp users have reportedly been receiving spam messages from a foreign phone number, informing that their WhatsApp number was selected to win a prize. Users who block the sender's number would then have their WhatsApp account suspended for a certain period of time. Once their account is recovered, previous chat conversations might be lost if the user has not backed up their chats.

IMPACT

[ALERT] ADVISORY ON RDP BRUTE FORCE ATTACKS

BACKGROUND
    
A way for employees to access corporate devices is by using Remote Desktop Protocol (RDP). Remote Desktop is a remote management tool which allows you to connect to any computer and take over the desktop. It’s like you are sitting and looking at your own computer, only remotely. It is highly used especially during this pandemic situation, for those who have moved to work from home. If poorly configured, it might be vulnerable to attacks.

IMPACT

Phone Scam

BACKGROUND
 
BruCERT has recently received a number of complaints from the public regarding phone scammers impersonating legitimate banks. The scammers contact victims through unofficial channels such as apps like WhatsApp or Viber, usually calling from an international number. They claim to be calling to check all customers’ cards and pressure the victim to reveal personal and financial information.

IMPACT

Bitcoin Storm Investment Scam

Background  

Fake news articles have been circulating on social media as sponsored ads, encouraging the public to invest in a cryptocurrency trading platform called Bitcoin Storm, which allegedly can transform anyone into a millionaire within 3-4 months.  

Impact  

  • May lead to huge financial losses 
  • Credit card or banking details will be stolen
  • Leakage of personal information such as email address, username and password 

Recommendations