The top attacker country was China with 148511 unique attackers (36.89%).
The top Trojan C&C server detected was Lokibot with 10 instances detected.
The top phishing campaign detected was againts Facebook with 44 instances detected.
The Red Piranha Threat Intelligence team uncovered an intricate cybersecurity attack targeting over eighty Australian businesses. Our team quickly crushed the threat by reverse-engineering the campaign and tools the attacker utilised, allowing them to locate and notify the affected parties swiftly. The cybercriminals used a technique to reject the victim's passwords three times, ensuring they gathered the maximum account of credentials without the user growing too suspicious.
FonixCrypter ransomware gang throws in the towel with MasterKey release
Well known ransomware-as-a-service cybergang FonixCrypter (also known as Xinof) has recently ceased its entire operations, leaving their life of crime behind.
Taking the industry by surprise, they announced via Twitter, that they had “Come to the conclusion we should use our abilities in positive ways and help others.” In addition to apologising to their victims as a sign of good faith, they released their MasterKey, deleted the ransomware source code and closed their Telegram channel, in which they used to advertise their malware campaigns in the dark web.
We recommend that those affected by FonixCrypters ransomware do not use the tool published and instead wait for a tool from an official source to decrypt their files as there is no guarantee that this tool is not in itself malicious.
Top Attackers By Country
Top Attackers By Country
- United States
- South Korea
Top Attacking Hosts
Top Network Attackers
|4134||China||CHINANET-BACKBONE No.31,Jin-rong Street, CN|
|4766||South Korea||KIXS-AS-KR Korea Telecom, KR|
Remote Access Trojan C&C Servers Found
|Amadey||3||188.8.131.52 , 184.108.40.206 , 220.127.116.11|
|Azorult||4||18.104.22.168 , 22.214.171.124 , 126.96.36.199 , 188.8.131.52|
|DiamondFox||2||184.108.40.206 , 220.127.116.11|
|Lokibot||10||18.104.22.168 , 22.214.171.124 , 126.96.36.199 , 188.8.131.52 , 184.108.40.206 , 220.127.116.11 , 18.104.22.168 , 22.214.171.124 , 126.96.36.199 , 188.8.131.52|
|Redirected||2||184.108.40.206 , 220.127.116.11|
Trojan C&C Servers Detected
Top Phishing Campaigns
CVEs with Recently Discovered Exploits
This is a list of recent vulnerabilities for which exploits are available.
CVE-2021-3118ECSIMAGING PACS 6.21.5 - SQL injection Vulnerability
|Unsupported versions of EVOLUCARE ECSIMAGING (aka ECS Imaging) products through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form. This allows an attacker to steal data in the database and obtain access to the application.||CVSSv3BaseScore:9.8(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)||01/11/2021||01/14/2021|
CVE-2020-11651Improper method call validation allows arbitrary code execution vulnerability
|This vulnerability exists in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.||CVSSv3BaseScore:9.8(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)||04/30/2020||08/19/2020|
CVE-2020-6207Missing Authentication Check in SAP Solution Manager
|SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager. ~||CVSSv3BaseScore:9.8(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)||03/10/2020||03/12/2020|
CVE-2020-17136Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
|Microsoft Windows could allow a local authenticated malicious user to gain elevated privileges on the system, caused by a flaw in the Cloud Files Mini Filter Driver. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.||CVSSv3BaseScore:7.8(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)||12/09/2020||12/11/2020|
CVE-2020-1472Netlogon Elevation of Privilege Vulnerability
|An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.||CVSSv3BaseScore:10(AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)||08/17/2020||12/24/2020|