Sep 25 2023
Welcome to Gone Phishing, your daily cybersecurity newsletter that treats cybercriminals like the Welsh lads treated the Aussies last night. With utter disrespect 🏉😳😂
Today’s hottest cybersecurity news stories:
⏳ Enter the ‘Sandman’: malware infects telecom providers in 3 continents 🌎
🕵️ To Catch a Predator: Egyptian ex-MP targeted with ‘Predator’ spyware 🛕
🏨 Hotel hackers redirect guests to fake Booking.com to steal cards 💳
👀 In a recent revelation, a mysterious threat actor named Sandman has been discovered, launching cyber attacks on telecom providers across the Middle East, Western Europe, and South Asia. 😱
📡 These attacks are stealthy and sophisticated, using a just-in-time compiler called LuaJIT to deploy a new implant named LuaDream. SentinelOne's security researcher Aleksandar Milenkoski says these intrusions involve strategic lateral movement and minimal engagement, indicating a deliberate approach to avoid detection.
🔍 Although the attacker's identity remains a mystery, evidence suggests a cyber espionage adversary targeting the telecom sector globally. These attacks surfaced in August 2023 and have been ongoing for weeks.
🔐 LuaDream's unique staging chain makes it hard to detect and analyze. It leverages LuaJIT to execute malicious Lua script code directly into memory. The prep work for this malware dates back to June 2022.
🦠 LuaDream appears to be a variant of a new malware strain known as DreamLand, described by Kaspersky as using Lua scripting language and JIT compiler for malicious code execution.
🛡️ Lua-based malware is rare, having been seen only three times since 2012. This modular backdoor has anti-debugging capabilities and communicates through various protocols.
💻 Stay vigilant! Cyber threats like Sandman are ever-evolving, and the telecom sector remains a target.
In related news, Chinese threat actors are launching strategic intrusions in Africa, targeting telecom, finance, and government sectors. 🌍
Stay secure, and keep an eye on your digital world! 👁️🌐
I came across ZZZ money club during the crypto market bull run when everyone’s a winner, even during the bear market this discord group has been amazing at giving information on projects and ways to make passive income in various ways.
The group is very active and everyone in this private discord group is very chatty and helpful.
Its run by Yourfriendandy and Decadeinvestor, you can find them here on YouTube, both top guys with great content.
If you are interested in joining the group you can through the link below.
📅 On September 21, 2023, Apple addressed three zero-day vulnerabilities used in an iPhone exploit chain targeting Ahmed Eltantawy, a former Egyptian member of parliament. 😮
🕵️♂️ The attack, attributed with high confidence to the Egyptian government, aimed at Eltantawy after he announced plans to run for President in the 2024 Egyptian elections.
💌 The spyware, known as Predator, was delivered via SMS and WhatsApp links, infecting Eltantawy's phone when he visited non-HTTPS websites.
🛡️ The exploit chain used three vulnerabilities to bypass security and execute code on the targeted device.
📣 Predator, developed by Cytrox, is similar to NSO Group's Pegasus and is part of the Intellexa Alliance, which was blocklisted by the U.S. government for human rights abuses.
💻 The attack involved a complex network injection attack, redirecting Eltantawy to malicious sites.
🚨 Google TAG researcher Maddie Stone explained it as an adversary-in-the-middle (AitM) attack, exploiting HTTP sites to redirect victims.
📩 Eltantawy received SMS and WhatsApp messages with disguised links that led to spyware installation.
🚫 To stay safe from such attacks, it's crucial to keep devices updated and enable Lockdown Mode on Apple devices.
🌐 This incident highlights the need for encryption and cybersecurity vigilance in the ever-evolving digital landscape.
Stay secure, and watch out for suspicious messages! 👁️📲
Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!
💊 HealthHack: Tech is making it easier than ever to reach your fitness goals, from wearable devices to nutrition apps, this newsletter does the research for you, get all the latest health tech gadgets delivered to your inbox.
₿ Crypto Nutshell: A well written and beautifully designed newsletter giving you the lowdown on crypto and web3, highly recommend if interested to get up to date info on the crypto/web3 market.
🧠 Big Brain: Trending AI news, jobs and tools delivered in 3 minutes per day.
Let us know what you think!
👾 Security researchers have uncovered a crafty information-stealing scheme targeting hotels, booking sites, and travel agencies. Here's what you need to know to stay safe! 😱
🚪 The Hackers' Entry: Cybercriminals breach these travel-related systems and then set their sights on customers' financial data.
💼 Indirect Approach: To up their success rate, they use a fake Booking.com payment page, making it tricky to spot their tricks.
🧩 Phishing Masterclass: These attacks begin innocently, often involving a reservation query or referencing an existing booking. Then, the criminals create a compelling reason, like a medical condition, to send important documents via a URL.
🦠 Stealthy Malware: The URL leads to sneaky info-stealing malware designed to quietly collect your sensitive data, like credentials and financial info.
💌 The Customer Target: After hitting the hotel or agency, the hackers gain access to legit customer messages. Then, they send phishing messages that look just like official requests for credit card verification. These messages are written professionally, making them appear completely genuine.
🛡️ Top Tips:
🚫 Don't click unsolicited links, even if they seem legit.
🧐 Be suspicious of urgent messages demanding immediate action.
🌐 Check URLs for signs of deception.
✉️ To be sure, contact the company directly using official email addresses or phone numbers to verify messages.
Stay savvy and outsmart those cyber tricksters! 🌟
So long and thanks for reading all the phish!
