Description: There has been notice of a worldwide Spam campaign targeting users in the United States with payloads of Locke and FakeGlobal ransomware. The emails resemble legitimate invoices or bills with a link to a zip archive containing the malware. Being infected could mean needing to pay a ransom to get files back.

Systems Affected: Email Services

Recommendations: Ensure that all anti-virus programs and associated signature files are up to date, and utilize caution when conducting business through email links.

Reported: September 4, 2017

Details: 26,000 servers were recently hijacked within the scope of a week. Attackers scanned the Internet for MongoDB databases left open and then deleted the databases, asking for a ransom to restore the data. Upon payment of the ransom, it was found that the attackers did not have the data, but had in actuality wiped the databases. This has been dubbed a continuation of the MongoDB Apocalypse that occurred in December 2016.

Solution: Ensure all MongoDB databases exposed to the Internet are updated to the latest version and that all security settings are configured correctly. Often the default security settings are insufficient to prevent hackers from exploiting the database.

Reference:

Reported: September 18, 2017

Details: Malware was distributed to 2.27 million users by hackers who were able to install malware into the CCleaner software. Users who downloaded CCleaner were also downloading malicious software contained within the application. It is possible that backdoors were installed on all systems who downloaded the infected CCleaner, including Microsoft and Cisco.

Solution: If you utilize CCleaner and have downloaded (or updated) it recently, ensure that CCleaner has been patched to the latest version as it has removed the malware from it. Additionally, it is important to conduct security scans and assessments on your network to ensure that the malware did not install a backdoor on your system.

 References:

Reported: September 16, 2017

Details: Name squatting attacks occurred in the official Python packages repository, whereby developers who made typos downloaded python packages that contained malicious code through popular tools such as “pip”. Attackers created packages with similar names to widely used packages, and copied their contents but added a few extra lines of code that installed malware on the developer’s computer when downloaded.

Solution: Check python projects from the past three months to determine if all packages are valid.

 References: