Threat Intelligence Roundup Highlights Breaches, Malware and Cybercrime Operations
Summary
A September threat intelligence roundup covers a fintech breach, phishing targeting diplomats, cybercrime arrests, FBI alerts, ransomware-related airport disruption, malware attacks on developer accounts and Android ad fraud.
Key points
- Hackers used stolen IT-vendor credentials to access Sinqia’s Pix payment systems in an attempted $130 million heist; Evertec said it recovered an undisclosed portion.
- An Iranian-nexus group reportedly used spear-phishing emails and macro-enabled Word documents to target diplomats and organizations across multiple regions.
- The FBI issued an alert on cybercriminal groups UNC6040 and UNC6395; Salesforce revoked Drift tokens and required customers to reauthenticate after a data exposure.
- A ransomware attack on Collins Aerospace’s MUSE system disrupted check-in and boarding at several European airports, delaying or canceling more than 100 flights; the incident was reported resolved by Monday.
- An attack involving a flaw in an Nx GitHub Actions workflow exposed 2,180 accounts and 7,200 repositories; telemetry.js malware sought tokens, SSH keys, environment files and crypto wallets.
- INTERPOL’s Operation Serengeti 2.0 led to 1,209 arrests, the recovery of $97.4 million and the dismantling of 11,432 malicious infrastructures.
- Google removed 224 SlopAds applications from Play; the apps had more than 30 million downloads and generated 2.3 billion ad requests per day.
Article Details
- Event Type
- Cybersecurity news roundup covering a fintech breach, phishing and credential theft, cybercrime enforcement, ransomware disruption, malware campaigns, and infrastructure takedowns.
- Impact
- Reported impacts include attempted unauthorized transfers targeting Brazil's Pix system, exposure of 2,180 accounts and 7,200 repositories, theft of credentials and other secrets, disrupted airport check-in and boarding systems with more than 100 delayed or cancelled flights, and large-scale fraud and cybercrime operations. Evertec reported recovering an undisclosed portion of the targeted $130 million; the airport incident was reported resolved by Monday. The roundup does not provide malicious infrastructure indicators.
People
Threat Actors
UNC6040Tracked cybercriminal group associated with social engineering and vishing attacks connected to Salesforce accounts.UNC6395Tracked cybercriminal group reported to have targeted Salesforce support-case information and exfiltrated data containing secrets, credentials, and authentication tokens.
Malware
Vendors
Collins AerospaceThe attack targeted Collins Aerospace, the external provider for both systems.EvertecSinqia, Evertec’s Brazilian subsidiary, disclosed to the U.S.Google8. Google nukes 224 Android malware apps behind massive ad fraud campaign – Bleeping ComputerHUMANThe operation was discovered by HUMAN’s Satori Threat Intelligence team.
Products
GitHub ActionsOn August 26, threat actors exploited a flaw GitHub Actions workflow in the Nx repository resulting in the exposure of 2,180 accounts.MuseBeginning Friday evening, hackers targeted the MUSE (Multi-User System Environment) system, causing over 100 delayed and cancelled flights throughout the weekend.PixThe hackers specifically targeted their Brazilian Central Bank real-time payment system, Pix.SalesforceThe alert follows the tracking of UNC6395, which targeted company’s support case information in Salesforce” that occurred from August 8th – 18th.