The top attacker country was China with 160695 unique attackers (57.05%).
The top phishing campaign detected was against Facebook accounts with 49 instances detected.
Microsoft Office Phishing Attack Hosted on Google Firebase
Security Researchers at Armour Blox have uncovered a phishing campaign designed to steal Microsoft login credentials via invoice-themed emails sent out to at least 20,000 recipients. The emails conveyed a realistic subject line of ‘Transfer of Payment Notice for Invoice” and contained a link to download the ‘invoice’ from the cloud.
Upon clicking the link, the target is lead through several re-directs, landing a Microsoft branded landing page was designed to collect Microsoft login credentials, secondary email addresses, phone numbers.
Google’s new Open-Source Vulnerability Database
Google has recently launched the OSV, an Open-Source Vulnerabilities website as their first step towards improving vulnerability triage for developers and consumers of open-source software.
OSV has been developed to provide precise data on how the vulnerability was introduced and where it was fixed—enabling consumers of open-source software to determine if they were impacted and make the required security adjustments to their systems and software.
Google has stated that it has two primary goals for OSV:
"Reduce the work required by maintainers to publish vulnerabilities.
Improve the accuracy of vulnerability queries for downstream consumers by providing precise vulnerability metadata in an easy-to-query database (complementing existing vulnerability databases)."
Commonwealth Ombudsman finds instances of telco data accessed without authority at all agencies inspected.
Last week the Federal Government tabled the Commonwealth Ombudsman's report on agency access to stored communications and telecommunications data for 2018-2019. While the Ombudsman was overall upbeat concerning the overall improvement of most agencies data compliance requirements, all agencies reviewed failed to follow the legal authorisation requirements.
Agencies included within the Ombudsman's report include:
- Australian Federal Police
- Australian Criminal Intelligence Commission,
- Department of Home Affairs advice
- New South Wales Police
- Queensland Police Force
- Tasmanian Police Force
- Victorian Police Force and
- The Western Australian Police Force
"We identified instances at all inspections in 2018-19, where agencies had accessed telecommunications data without proper authority. As such, the disclosure of the data was unauthorised," the report [PDF] said in the section dedicated to telco data inspections".
Top Attackers By Country
Top Attackers By Country
- United States
Top Attacking Hosts
Top Network Attackers
|4134||China||CHINANET-BACKBONE No.31,Jin-rong Street, CN|
|7506||Japan||INTERQ GMO Internet,Inc, JP|
|4837||China||CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN|
|46475||United States||LIMESTONENETWORKS, US|
|38019||China||CMNET-V4TIANJIN-AS-AP tianjin Mobile Communication Company Limited, CN|
|45903||Vietnam||CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN|
|45090||China||CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN|
Top Phishing Campaigns
CVEs with Recently Discovered Exploits
This is a list of recent vulnerabilities for which exploits are available.
CVE-2021-1144Cisco Connected Mobile Experiences Privilege Escalation Vulnerability
|A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow a remote, authenticated attacker without administrative privileges to alter the password of any user on an affected system. The vulnerability is due to incorrect handling of authorization checks for changing a password. An authenticated attacker without administrative privileges could exploit this vulnerability by sending a modified HTTP request to an affected device. A successful exploit could allow the attacker to alter the passwords of any user on the system, including an administrative user, and then impersonate that user.||CVSSv3BaseScore:9.8(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)||01/13/2021||01/20/2021|
CVE-2021-25311HTCondor Directory Traversal Vulnerability
|condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory, as demonstrated by creating a file under /etc that will later be executed by root.||9.9(AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)||01/27/2021||02/01/2021|
CVE-2021-1647Microsoft Defender Remote Code Execution Vulnerability
|This vulnerability exists in Microsoft's Defender antivirus software. Attackers can write specially crafted files that can be run immediately when Microsoft Defender initiates the scans. Attackers can use this vulnerability not only to bypass Microsoft anti-virus software but also to use Microsoft anti-virus software to run malicious software to launch an attack. This means that an attacker can launch an on-interactive attack, such as sending a specially crafted file as an email attachment, and the email client will trigger a scan after receiving it.||3.1(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)||01/12/2021||01/14/2021|
CVE-2020-4888IBM QRadar SIEM Deserialization of Untrusted Data
|IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to execute arbitrary commands on the system.||8.8(AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)||01/28/2021||02/02/2021|