Friday Five 1/6

by Robbie Araiza on Friday January 6, 2023

The holidays saw a wave in cybercrime and rampant malware, but also some good news for those affected by MegaCortex Ransomware. Read about these stories and more in this week's Friday Five.

1. BITRAT MALWARE CAMPAIGN USES STOLEN BANK DATA FOR PHISHING BY SERGIU GATLAN

Over 400,000 records containing sensitive customer data including names, addresses, phone numbers, email addresses, Colombian national IDs, payment records, and salary information were stolen from an undisclosed Colombian cooperative bank and are now being used as lures in phishing emails designed to infect targets with the BitRAT remote access trojan. According to security firm Qualys, "the lures themselves contain sensitive data from the bank to make them appear legitimate. This means that the attacker has gotten access to customers’ data." Read more about what was found in the investigation and how BitRAT malware works in the full story from BleepingComputer.

2. CYBERATTACKERS TORCH PYTHON MACHINE LEARNING PROJECT BY ROBERT LEMOS

PyTorch Python, a popular project for data scientists and machine learning developers, was recently targeted in a dependency confusion attack, allowing a malicious function to grab a variety of information from infected systems, including the username, environment variables, a list of hosts to which the victim's machine connects, the list of password hashes, and the first 1,000 files in the user's home directory. The attack reportedly affects those that downloaded a nightly build between Dec. 25 and Dec. 30. Learn more about how the attack was accomplished and how it's only the latest in a string of software supply chain attacks.

3. EUROPEAN REGULATORS FINE META OVER $400 MILLION FOR TARGETED AD PROGRAM BY TONYA RILEY

In violation of Europe's General Data Protection Regulation (GDPR), Irish regulators fined Meta roughly $414 million for coercing users to consent to behavioral advertising. Meta reportedly forced this advertising on users by including a clause allowing the practice within an updated terms of service agreement, which the user must agree upon to use the platform. Despite planning to appeal its latest fine, Meta has now accumulated well over $1 billion in fines for similar violations.

4. BITDEFENDER RELEASES FREE MEGACORTEX RANSOMWARE DECRYPTOR BY BILL TOULAS

As a result of the combined work of Bitdefender analysts and experts from Europol, the NoMoreRansom Project, and the Zürich Public Prosecutor's Office and Cantonal Police, a decryptor for the MegaCortex ransomware family has recently been made available, making it possible for victims to restore their data for free. The tool is currently available for download from Bitdefender's website. Read about the decryptor's capabilities and the rise and fall of the once-notorious MegaCortex ransomware in the full story from Bill Toulas at BleepingComputer.

5. HUNDREDS OF WORDPRESS SITES INFECTED BY RECENTLY DISCOVERED BACKDOOR BY DAN GOODIN

According to a recent writeup, malware that exploits unpatched vulnerabilities in 30 different WordPress plugins has infected hundreds if not thousands of sites and may have been in active use for years. According to the researchers, “If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted web pages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites.” In the full story from Ars Technica, read the list of all 30 potentially harmful plugins and be sure to update them to their most current versions as needed.

Tags: Malware , Cybercrime , Compliance , Vulnerabilities

Robbie Araiza

Robbie is a Content Creator for the Data Protection team at Fortra. Prior to joining the organization, he studied psychology and social work at Texas State University in San Marcos, TX.