Android phones with built-in viruses are being sold / Hackers steal crypto from Bitcoin ATMs / U.K. car dealership giant hacked

Plus: One of the largest gas distribution companies in Greece has been hacked

Inside.com Part of   Network August 22, 2022

Presented by

Researchers have found Android phones with built-in viruses that hack WhatsApp accounts. The phones are sold by scammers and run old software versions. More: Researchers have found that some models such as P48pro, radmi note 8, Note30u, and Mate40 are sold with pre-built trojans that target WhatsApp accounts. Hackers are able to breach WhatsApp by modifying two files: (/system/lib/libcutils.so) and (/system/lib/libmtd.so). The files are modified so that when the libcutils.so system library is used by any app, a trojan is automatically deployed in the phone. If the deployment is successful, threat actors can gain access to messages and phone calls. Researchers believe that the trojan used by hackers is part of the SOCGholish malware family.

Hackers have stolen cryptocurrency from Bitcoin ATMs. Hackers stole the cryptocurrency by breaching ATM manufacturer General Bytes through a zero-day flaw. More: The company does not know how much cryptocurrency was stolen.  Hackers created a fake administrator account and used it to abuse CAS. The latter is a central software platform used to manage Bitcoin ATMs. The threat actor forwarded all cryptocurrencies deposited in the ATM toward its own wallet address, while the origin of this address is still unknown. General Bytes claims that it patched two issues that were susceptible to hacks like this one, but the recent bug was unnoticed by the company. The company also added that this breach happened only three days after it published a message in support of Ukraine.

A message from QUANTUM Effective and Reliable Data Storage Protection that Scales on Your Terms and Budget. Data recovery is possible across the entire lifecycle - and air-gapped protection is both the safest and the lowest TCO. Successful Ransomware attacks can take months to fully recover from - especially when targeted campaigns wipe out clusters of servers. So why not choose a solution that protects and recovers at any point in your data’s lifecycle? With different tiers, you’re able to ensure availability of data without compromise. You’re able to balance cost while maximizing efficiency. No one can stop ransomware or fully prevent it from taking place - but you can make sure you’re protecting your customers and your data by ensuring that there is a fully air-gapped solution. Request A Demo

Holdcroft Group, one of the largest U.K. car dealerships, has been hacked by unknown threat actors. The breach happened last month and resulted in massive data leakage.  More: Hackers stole personal employee information and managed to damage several parts of the company's IT infrastructure permanently. The company has told its employees to change all of their personal account passwords and to avoid using their work devices for the time being. Hackers used ransomware as a threat vector, asking for ransom after hitting the company with a cyberattack. It is unclear how the company proceeded after the demand. Holdcroft Group has notified the police and the National Cyber Security Centre, both of which are investigating the attack. Zoom Out: Earlier this year, U.K. dealership TrustFord was hit by a cyberattack. The attack shut down multiple websites the company operates. LSH Auto, another U.K. dealership, was sued a few months ago after failing to report to its employees regarding a data breach.

The largest Greek natural gas distribution company has been hacked. The news was announced by DESFA online. More: According to the public statement, hackers from Ragnar Locker group tried to steal classified information but were unable to do so because the company's IT department managed to stop them. These hackers did, however, steal a limited amount of information, according to the company. DESFA has shut down numerous online services in order to make sure that hackers cannot access customer data, but it plans to gradually restore the services in the upcoming weeks. The gas distributor stated that it would not pay ransom to the threat actor, adding that it notified all law authorities in the country regarding the case. Ragnar Locker has leaked a limited amount of stolen data, threatening to release more if its demands are not met.  Zoom Out: This cyberattack corresponds with the recent gas crisis in Europe. Many European countries have warned that there are going to be electricity cuts and an increase in bills due to higher gas import prices that come as a result of the war in Ukraine.

A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work. They are manual, inconsistent, take too long, don’t scale, and don’t give developers what they need. When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by: Design through automating threat modeling Generating application security requirements Providing secure development Compliance best practices. The SD Elements platform is the best solution for organizations who need to scalably model software threats, identify countermeasures, and deliver secure, compliant code quickly. Download the whitepapers

A new malware campaign is targeting manufacturers in Spain and Mexico. Hackers aim to deploy the Grandoreiro banking malware. More: Grandoreiro has been actively deployed since 2016 in hacking campaigns that have targeted the automotive, civil, industrial, construction, logistics, and machinery industries in Mexico. The malware has also been used in Spain to hit chemical manufacturing companies. Grandoreiro is a backdoor malware deployed after users click an infected ZIP file. The malware's capabilities are wide-ranging and include: recording keystrokes, stealing log-in credentials, crypto-wallet credentials, bank account information, etc. The malware can update remotely and send the information to the threat actors who deploy it.

Quick Hits: Top companies are planning their holiday gifting now. Here’s why their gifts are sure to be a success.* A new Remote Access Trojan called Borat RAT has been tracked by researchers. The RAT enables hackers to launch DDoS attacks. A Linux security flaw tracked as CVE-2022-2588 has been found. The security flaw is at least eight years old, making it a unique development in cybersecurity. The flaw has been named DirtyCred and was found by Northwestern University researchers. Mysterious Dream has used Raven Storm to launch DDoS campaigns against its targets. The Python-coded malware is able to disrupt servers, wi-fi networks, etc. A new RAT that takes advantage of Microsoft Office applications has been tracked. The RAT, named Escanor, is also able to abuse PDF files. The malware is being offered for sale to more than 28,000 subscribers online. Five ways you can use content and data to create a cycle of unforgettable customer experiences.* *This is sponsored content.

Upcoming events at Inside: August 24 - AMA with Matt Mahar (CEO at Cana) (Register Here) August 30 - An overview of simulation and cloud tools in embedded software (Register Here) * August 31 - AMA with Sophia Amoruso (CEO at Business Class) (Register Here) September 07 - AMA with Andrew Gazdecki (Founder of MicroAcquire) (Register Here) September 09 - AMA with Jay Ryan (U.S. Federal Government Program Manager at Security Compass) (Register Here) September 14 - AMA with Brian Dean (Founder of Backlinko) (Register Here) September 21 - AMA with Kristen Ruby (Founder of Ruby Media Group) (Register Here) September 28 - Free Access to the Semantic Layer Summit with 30+ Enterprise Data Leaders (Register Here) * September 28 - AMA with Leigh-Ann Buchanan (Founder of aīre ventures) (Register Here) October 12 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here) October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

With Quantum, we shift the focus from accumulating data to making it work for you.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.