Cyber Threat Intelligence 21 January 2025

NCSA_THAICERT

Malware

CERT-UA Warns Against “security Audit” Requests Via AnyDesk
"Attackers are impersonating the Computer Emergency Response Team of Ukraine (CERT-UA) via AnyDesk to gain access to target computers. “Unidentified individuals are sending connection requests via AnyDesk under the pretext of conducting a ‘security audit to verify the level of protection,’ using the name ‘CERT.UA,’ the CERT-UA logo, and the AnyDesk ID “1518341498” (which may vary),” CERT-UA explained on Friday."
https://www.helpnetsecurity.com/2025/01/20/cert-ua-warns-against-security-audit-requests-via-anydesk/
Android Malware In DONOT APT Operations
"The research team at CYFIRMA collected a sample attributed to the Indian APT group known as ‘DONOT’, which appears to serve Indian national interests, and additionally seems to have been designed for intelligence gathering against internal threats and uses an innocent customer engagement platform for malicious purposes."
https://www.cyfirma.com/research/android-malware-in-donot-apt-operations/
https://thehackernews.com/2025/01/donot-team-linked-to-new-tanzeem.html
https://securityaffairs.com/173257/apt/donot-team-android-malware.html
https://www.infosecurity-magazine.com/news/indian-apt-group-donot-app/
Gmail For Exfiltration: Malicious Npm Packages Target Solana Private Keys And Drain Victims' Wallets
"Socket’s threat research team has uncovered malicious npm packages designed to exfiltrate Solana private keys via Gmail. The packages – @async-mutex/mutex, dexscreener, solana-transaction-toolkit and solana-stable-web-huks – typosquat popular libraries and appear to serve legitimate purposes. However, instead they function as malware, with the final two packages also draining victims’ Solana wallets."
https://socket.dev/blog/gmail-for-exfiltration-malicious-npm-packages-target-solana-private-keys-and-drain-victim-s
https://thehackernews.com/2025/01/hackers-deploy-malicious-npm-packages.html
https://securityaffairs.com/173249/cyber-crime/malicious-npm-and-pypi-target-solana-private-keys.html

Breaches/Hacks/Leaks

Hundreds Of Thousands Of Records Exposed Online In FinTech Bill Pay Platform Data Breach
"Cybersecurity Researcher, Jeremiah Fowler, discovered and reported to Website Planet about a non-password-protected database that contained over 240,000 records belonging to Willow Pays — a payment software company offering AI software solutions to allow users to finance bills and other payments."
https://www.websiteplanet.com/news/report-willowpays-breach/
https://hackread.com/fintech-bill-pay-willow-pays-exposes-240000-records/
Ransomware Attack Forces Brit High School To Shut Doors
"A UK high school will have to close for at least two days, today and tomorrow, after becoming the latest public-sector victim of ransomware criminals. Blacon High School in the historic city of Chester, in north west England, said yesterday the attack hit on January 17, and didn't rule out having to shut its doors to students for additional days this week. Students have not been given the day off, however. Teachers set work for them to complete on Google Classroom over the two days, although they can still visit the school to collect lunch."
https://www.theregister.com/2025/01/20/blacon_high_school_ransomware/

General News

6 Cyber Security Challenges Emerge From World Economic Forum, Check Point Research On 2025 Threats
"As we step into 2025, the cyber security landscape continues to be as complex as ever for security leaders looking to protect their organizations from increasingly injurious cyber threats. The World Economic Forum (WEF) detailed some of the most challenging threats in its Global Cyber security Outlook 2025, with some critical areas of concern mirroring those in our own State of Cyber security Report 2025. Both reports emphasize the growing sophistication of cyber threats, the integration of emerging technologies to make cyber threats harder to detect and deter, and the outsized influence of global geopolitical factors influencing cyber security threats."
https://blog.checkpoint.com/security/6-cyber-security-challenges-emerge-from-world-economic-forum-check-point-research-on-2025-threats/
AI Predictions For 2025: A Cyber Security Expert’s Perspective
"As we approach 2025, the rapid evolution of artificial intelligence (AI) is set to dramatically reshape the cyber security landscape. As an AI and cyber security expert, I foresee several key developments that will significantly impact our digital world. The surge in AI usage will have far-reaching implications for areas such as energy consumption, software development, and ethical and legal frameworks. Of course, AI technologies will also be weaponized by cyber criminals and nation state actors, creating new and formidable threats to cyber security."
https://blog.checkpoint.com/artificial-intelligence/ai-predictions-for-2025-a-cyber-security-experts-perspective/
Phishing Attacks Are The Most Common Smartphone Security Issue For Consumers
"New research from Omdia shows that the security capabilities on several of the latest consumer smartphones, including top devices from Apple, Google, and Samsung, fail to detect several types of common phishing attacks. As part of the fourth-annual Omdia Mobile Device Security Scorecard, Omdia surveyed 1,572 consumers across 13 major countries in the Americas, Asia and Oceania, and Europe, in October 2024. This survey covered the demographics of smartphone users, their security concerns and attitudes, their perception of the most common security threats, and the key smartphone purchasing drivers."
https://www.darkreading.com/mobile-security/phishing-attacks-are-most-common-smartphone-security-consumer-issue
https://omdia.tech.informa.com/om124947/mobile-device-security-scorecard-2024
Preventing Unintended Encryption Of Amazon S3 Objects
"At Amazon Web Services (AWS), the security of our customers’ data is our top priority, and it always will be. Recently, the AWS Customer Incident Response Team (CIRT) and our automated security monitoring systems identified an increase in unusual encryption activity associated with Amazon Simple Storage Service (Amazon S3) buckets. It’s important to note that these actions do not take advantage of a vulnerability within an AWS service—but rather require valid credentials that an unauthorized user uses in an unintended way. Although these actions occur in the customer domain of the shared responsibility model, AWS recommends steps that customers can use to prevent or reduce the impact of such activity."
https://aws.amazon.com/blogs/security/preventing-unintended-encryption-of-amazon-s3-objects/
https://www.bankinfosecurity.com/amazon-details-measures-to-counter-s3-encryption-hacks-a-27339
Decentralization Is Happening Everywhere, So Why Are Crypto Wallets “walled Gardens”?
"The twin cryptocurrency and digital identity revolutions are supposed to be building a better future, where anybody can take charge of their sovereignty and security in a world where both face unprecedented threats. Yet at one crucial level, the decentralization ecosystem has a glaring vulnerability: consumer hardware wallets. Devices like Ledger sell themselves as the last word in security for the crypto economy. Most end users will accept those marketing messages, hook, line, and sinker."
https://www.helpnetsecurity.com/2025/01/20/crypto-hardware-wallets/
One In Ten GenAI Prompts Puts Sensitive Data At Risk
"Despite their potential, many organizations hesitate to fully adopt GenAI tools due to concerns about sensitive data being inadvertently shared and possibly used to train these systems, according to Harmonic. A new study, based on tens of thousands of prompts from business users, reveals that nearly one in ten potentially disclose sensitive data. The prompts have been analyzed by Harmonic Security during Q4 of 2024 and monitor the use of GenAl tools including Microsoft Copilot, OpenAl ChatGPT, Google Gemini, Anthropic’s Claude, and Perplexity."
https://www.helpnetsecurity.com/2025/01/20/genai-prompts-risk/
AI-Driven Insights Transform Security Preparedness And Recovery
"In this Help Net Security interview, Arunava Bag, CTO at Digitate, discusses how organizations can recover digital operations after an incident, prioritize cybersecurity strategies, and secure digital operations with effective frameworks."
https://www.helpnetsecurity.com/2025/01/20/arunava-bag-digitate-securing-digital-operations/

อ้างอิง
Electronic Transactions Development Agency(ETDA)