Ransomware is old school - Crypto-mining is the new trend

A single hijacked box can typically mine about 25 cents of Monero a day. Multiply that over tens of thousands of machines, and it adds up to a nice little earner

Criminals are cutting out the middle person – the human victim – and infecting machines with remote-controlled malware that quietly mines alt-coins and slips the digital dosh back to its masters.

Criminals are shifting from coining it with ransomware to raking it in directly with stealthy miners.


Here is the fun part
The Talos team found one inept CPU-cycle thief who was installing open-source mining code called NiceHash Miner, which is on GitHub. The crook forgot to change the default settings in the app, meaning that any coinage mined when to the software's developer, not the idiot sticking it on other people's systems.


https://www.theregister.co.uk/2018/02/01/monero_mining_malware/

Want to hack into systems exposed to Internet - No skills needed just run "AutoSploit" Script.

It crawls the internet looking for machines that are possibly vulnerable to attack – typically due to unpatched security bugs – and automatically takes over them for you

The software, posted publicly on GitHub this week by someone calling themselves Vector, is called AutoSploit. It makes mass hacking exceedingly easy. After collecting targets via the Shodan search engine – an API key is required – the Python 2.7 script attempts to run Metasploit modules against them.

https://www.theregister.co.uk/2018/01/31/auto_hacking_tool/

Have you updated your Cisco VPN device(s) - A critical vulnerability with CVSS score of 10 has been fixed

On January 29, Cisco released a high-urgency security alert for customers using network security devices and software that support virtual private network connections to corporate networks. Firewalls, security appliances, and other devices configured with WebVPN clientless VPN software are vulnerable to a Web-based network attack that could bypass the devices’ security, allowing an attacker to run commands on the devices and gain full control of them. This would give attackers unfettered access to protected networks or cause the hardware to reset. The vulnerability has been given a Common Vulnerability Scoring System rating of Critical, with a score of 10—the highest possible on the CVSS scale.

https://arstechnica.com/information-technology/2018/01/cisco-drops-a-mega-vulnerability-alert-for-vpn-devices/

What is JackPotting? - You make the ATM give you a lot of cash (like a Slot Machine)

Thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash 


The Secret Service alert explains that the attackers typically use an endoscope — a slender, flexible instrument traditionally used in medicine to give physicians a look inside the human body — to locate the internal portion of the cash machine where they can attach a cord that allows them to sync their laptop with the ATM’s computer.


https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/

Meltdown, Spectre patch drama continues - first they said "PATCH it is critical", then "WAIT it will break", then "GO AHEAD" then, Intel says "oops we did not test our patches properly" and today Microsoft wants to uninstall one of its patches.

Microsoft has issued on Saturday an emergency out-of-band Windows update that disables patches for the Spectre Variant 2 bug (CVE-2017-5715).

The update —KB4078130— targets Windows 7 (SP1), Windows 8.1, all versions of Windows 10, and all supported Windows Server distributions.


https://www.bleepingcomputer.com/news/microsoft/microsoft-issues-windows-out-of-band-update-that-disables-spectre-mitigations/

If you own ASUS router then it is time to act (I mean patch)

ASUS released patches for over a dozen router models on Tuesday that are each vulnerable to multiple firmware flaws that when combined give a local unauthenticated attacker the ability to execute commands as root on targeted devices

However
The attack is done from the LAN side the network, as opposed to the WAN side. In other words, as far as we know you cannot exploit this from the internet



https://threatpost.com/asus-patches-root-command-execution-flaws-haunting-over-a-dozen-router-models/129666/

Its a wonderful (Scary) world (Keylogger in wordpress sites)

What is typed in the forms is sent to the hackers even before the user has clicked on the “log in” button.


Many web surfers almost certainly don’t realise that the reason that their laptop’s fan is running at full blast is because the website they are viewing is tied up with the complex number-crunching necessary to earn the digital currency.

But, in a twist, this particular attack isn’t just interested in mining Monero. While the website’s front-end is digging for cryptocurrencies, the back-end is secretly hosting a keylogger

https://hotforsecurity.bitdefender.com/blog/keylogger-found-on-thousands-of-wordpress-based-sites-stealing-every-keypress-as-you-type-19501.html