Threat Intelligence Report February 1st - 7th February 2021

 
  Trends

• The top attacker country was China with 160695 unique attackers (57.05%).

• The top phishing campaign detected was against Facebook accounts with 49 instances detected.
  
  Microsoft Office Phishing Attack Hosted on Google Firebase 

  Security Researchers at Armour Blox have uncovered a phishing campaign designed to steal Microsoft login credentials via invoice-themed emails sent out to at least 20,000 recipients. The emails conveyed a realistic subject line of ‘Transfer of Payment Notice for Invoice” and contained a link to download the ‘invoice’ from the cloud.  

  Upon clicking the link, the target is lead through several re-directs, landing a Microsoft branded landing page was designed to collect Microsoft login credentials, secondary email addresses, phone numbers. 
  
  Google’s new Open-Source Vulnerability Database 
   
  Google has recently launched the OSV, an Open-Source Vulnerabilities website as their first step towards improving vulnerability triage for developers and consumers of open-source software. 
  
  OSV has been developed to provide precise data on how the vulnerability was introduced and where it was fixed—enabling consumers of open-source software to determine if they were impacted and make the required security adjustments to their systems and software.  
  
  Google has stated that it has two primary goals for OSV: 

  • "Reduce the work required by maintainers to publish vulnerabilities. 

  • Improve the accuracy of vulnerability queries for downstream consumers by providing precise vulnerability metadata in an easy-to-query database (complementing existing vulnerability databases)."

Commonwealth Ombudsman finds instances of telco data accessed without authority at all agencies inspected.

Last week the Federal Government tabled the Commonwealth Ombudsman's report on agency access to stored communications and telecommunications data for 2018-2019. While the Ombudsman was overall upbeat concerning the overall improvement of most agencies data compliance requirements, all agencies reviewed failed to follow the legal authorisation requirements.  

Agencies included within the Ombudsman's report include:  
- Australian Federal Police  
- Australian Criminal Intelligence Commission, 
- Department of Home Affairs advice  
- New South Wales Police  
- Queensland Police Force  
- Tasmanian Police Force  
- Victorian Police Force and  
- The Western Australian Police Force  

"We identified instances at all inspections in 2018-19, where agencies had accessed telecommunications data without proper authority. As such, the disclosure of the data was unauthorised," the report [PDF] said in the section dedicated to telco data inspections". 

  Top Attackers By Country

  Top Attackers By Country

  Threat Geo-location

  Top Attacking Hosts

Top Attackers

  Top Network Attackers

  Common Malware

  Top Phishing Campaigns

  CVEs with Recently Discovered Exploits

    This is a list of recent vulnerabilities for which exploits are available.