The next-generation CISO will need to master these 6 qualities to survive and thrive in the ever-changing world we live in. Click here to read more!

Attackers are abusing the Basecamp project management tool to launch phishing campaigns designed to distribute malware or steal credentials. Threat groups are distributing the BazarLoader backdoor Trojan using public Basecamp download links, warned the MalwareHunterTeam.

More:

• Basecamp is a web-based project management tool that includes to-do lists, milestone management, messaging, file sharing, and time tracking.
• BazarLoader deploys Cobalt Strike beacons that enable attackers to access a compromised network and deploy Ryuk ransomware.
• Ryuk ransomware attackers were behind the recent attack on Universal Health Services, which shut down some healthcare systems for more than a week. 

CYBER BREACH MONDAY:

Every Monday, I summarize the most important breaches, so you stay up-to-date on the latest cybersecurity incidents. In today's issue:

K-12 schools in the U.S: thousands of breach victims; personal information on students have been exposed in 99 school data breaches between 2016 and 2020, according to GAO data.

Presbyterian Healthcare Services (N.M.): 193,223 breach victims; hacking/IT incident.

To read more, click here to upgrade to premium!

Google recently disclosed that it mitigated a 2.54 Tbps distributed denial of service (DDoS) attack carried out by a Chinese state-sponsored actor in 2017, the largest DDoS attack ever recorded. Google said the attackers used a number of China-based internet service providers to carry out a user datagram protocol (UDP) amplification attack. 

More:

• The second-largest DDoS attack, a 2.3 Tbps attack, was mitigated by AWS earlier this year.
• Google warned that it has been seeing an increase in DDoS attacks by state-based groups recently.
• DDoS attacks increased by 151% year-over-year in the first half of 2020, according to stats from Neustar.

The Emotet botnet is sending fake messages from Windows Update instructing recipients to update Microsoft Word. The botnet then deploys a malicious Word attachment to compromise the victim's system, send spam email, and deploy ransomware. 

More:

• Emotet has been sending out spam emails since mid-October pretending to be invoices, shipping information, COVID-19 data, updates on President Trump's health, purchase orders, and other scams.
• Emotet began as a banking trojan and evolved into a spamming and malware delivery service.
• Earlier this month, the Cybersecurity and Infrastructure Agency and the Multi-State Information Sharing and Analysis Center warned that they had seen a "significant increase" in Emotet phishing emails targeting state and local governments.

Microsoft was the most impersonated brand for cyberattackers sending out phishing emails in Q3, according to Check Point researchers. Microsoft jumped from fifth place in Q2 to the top spot in the Q3, making up 19% of all brand phishing attempts.  

More from Check Point:

• Behind Microsoft was DHL with 9% of brand phishing attacks, Google with 9%, PayPal with 6%, Netflix with 6%, Facebook with 5%, Apple with 5%, WhatsApp with 5%, Amazon with 4%, and Instagram with 4%.
• Check Point judged that Microsoft's jump in the rankings was the result of threat actors trying to capitalize on the move to remote work during the Covid-19 pandemic.
• The most likely industry to be targeted by brand phishing was technology, followed by banking and social media.

Russsian citizen Alexander Vinnik is going on trial in Paris for defrauding nearly 200 victims of €135M ($158M) using ransomware. Vinnik is accused of sending phishing emails disguised as invoices, which deployed ransomware on the victims' computers when opened.

More:

• Vinnik allegedly carried out his ransomware campaign between 2016 and 2018 and targeted local authorities, businesses, and individuals.
• Greek authorities arrested Vinnik in 2017 and extradited him to France earlier this year. 
• Vinnik's lawyers accused the Greek government of abusing his human rights while he was in detention.
• Vinnik could also be extradited to the U.S. where he is accused of participating in the $4B hack of Mt. Gox bitcoin exchange. 

The new Gitjacker tool, developed by Liam Galvin, enables developers to find out if they have uploaded .git folders online, which could expose sensitive data to hackers. A .git folder stores repository data, which can provide an attacker access to raw source code and configuration data like database passwords and password salts.

More:

• Galvin explained that web servers with directory listings make an attack on .git folders easier for attackers.
• Gitjacker not only finds an exposed .git folder, but also enables the developer to extract the content. 
• Unfortunately, Gitjacker can also be abused by hackers to extract sensitive content from the .git folders.

Microsoft issued out-of-bound patches for bugs in Microsoft Windows Codecs Library and Visual Studio Code that could enable an attacker to launch a remote code execution (RCE) attack. The fixes come just days after Microsoft patched 87 bugs in its regular Patch Tuesday security update.

More:

• The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert that encourages users and administrators to apply the Microsoft patches.
• Justin Steven, who reported the Visual Studio Code flaw, tweeted that the problem stems from a bypass of a previously deployed patch for an RCE flaw in Visual Studio Code. 
• The exploitation of the Windows Codes Library requires a program to process a specially crafted image file.

TO KEEP UPDATE WITH SECURITY PATCHES FROM LEADING VENDORS, CHECK OUT MY WEEKLY PATCH WATCH COLUMN. To read more, Click here to upgrade to premium!

QUICK HITS:

• Windows GravityRAT can now be used to infect Android and macOS devices.
• Toshiba has received a contract from Japan's National Institute of Information and Communications Technology to install quantum key distribution encryption systems.
• Online sports betting site Commission Kings has been hit by a cyberattack that took the site offline over the weekend.
• Vizom malware employs remote overlay attacks to hijack bank accounts.
• Chargebee is organizing the largest tech summit for change-makers of the SaaS space, featuring champions from HubSpot, Drift, Dropbox, Slack, etc. Join here.*

*This is sponsored content.