It looks like there has been another round of malware identified on the Google Play sore and, you guessed it, the majority is focused on banks and other financial institutions. The combination of apps found totals around 515,000 downloads. 500,000 of these downloads are being attributed to a new trojan dubbed Octo and appears to be distributed via fake apps uploaded to the Google Play store.

Twitter has been in the new a lot over the last few years. From deleting accounts of people and groups for very flimsy reasons to censoring posts that contain factual, but non-popular information. It seems that they just cannot help themselves when it comes to abusing community standards. The practice has even accelerated after Jack Dorsey left the company as CEO. The seemingly one-sided application of community standards has led to much criticism of the platform. The level of disappointment even led to Elon Musk buying 9.2% of the company and gaining a seat on the board of directors (not that this will accomplish much).

For some reason, malware, attacker tools, and even the threat groups themselves tend to be viewed and talked about as static objects (outside of the security and threat analytics world). Malware is just Malware, the same with Ransomware strains. Once they get named, they are that way forever. However, that is the farthest thing from reality. Threat Groups evolve their tactics, toolsets, and they even have DevOps around their malware/ransomware.

Imagine you are standing at a charging station charging your shiny new EV. You smugly look at all the antiquated gas-powered cars as they pay large amounts of money to keep their old, polluting, conveyances functional. Suddenly your charging station just stops working. No reason is given just that you need to try again. You plug it in, and it happens again.

Over the weekend news surfaced that indicated users of Trezor hardware crypto wallets had received emails claiming Trezor had been breached and urging the user to reset their PIN as soon as possible. The emails turned out to be a phishing campaign that leveraged the compromise of MailChimp marketing tools. The latter was confirmed by MailChimp on Sunday after Trezor made the statement following the large number of reports on the phishing emails.

So, today is April 1st and with the net full of clever ideas to play a joke on readers it can be fun to sort through what is real and what is not. Because of this, we are going to take a day off to teak some confiigurations, maybe reload an system or two and just have some good bourbon in the process.

We will pick up our normal repoting tomorrow and will be throwing in some how-to's and explantions of different components, tools and more.

For any news letter subscribers, we are aware that our current system might not be sending them out properly and will be using this time to address that issue.

Thanks and have fun today!

The FBI, on March 29th, released a Private Industry Notification with vague details on a potential Phishing campaign targeting election officials in at least nine US states. The information in the advisory gives very broad information without really saying much. There is no information in the notification on which states were targeted and the phishing campaign sounds a lot like ones that are sent out to millions of people every day.

Just when you might have thought things were calming down with Lapsus$, they bounce back from a “vacation” and dump what they are claiming is 70GB of data from IT group Globant. The leak comes after police in London announced the arrest and release of seven individuals with possible ties to the group, including the possible leader of the organization.

Google pushed out a n Out-of-band patch for Chrome due to a high-severity on Friday (March 25th, 2022). The patch was pushed out quickly as the vulnerability, tracked as CVE-2022-1096 is being actively exploited in the wild. CVE-2022-1096 is a type confusion vulnerability that exists in the JavaScript Engine used by Chrome and was reported to Google by an Anonymous researcher last week.

Lat week we reported on the quick change in Okta’s stance on a January security incident that turned out to be much larger and have the volatile hacking group Lapsus$ behind it. The original disclosure was that a single third-party contractor account had an unsuccessful attempt to compromise Okta’s systems. Okta states that they turned over information around the incident to Sitel, the third-party that provides customer support. Once this was done, Okta basically washed their hands of it and sat back waiting to hear what Sitel found.