Cyber brief (June 2020)
CB 20-06 - Date: 03/06/2020 - Version: 1.1
TLP:WHITE
Europe and the European Union
The German authorities issued an arrest warrant for a Russian citizen in relation to the May 2015 breach of Cyberespionage
Bundestag IT systems. The activity is linked to APT28, associated with the Russian GRU intelligence agency.
Political affairs
According to a report by the German security services, the Russian-nexus Berserk Bear threat actor has been Cyberespionage
Energy
on a long-term campaign to compromise German companies in the energy and water sectors.
Water
The Estonian Internal Security Service (KAPO) reported that in 2019, state-sponsored hackers had infiltrated Cyberespionage
the Estonian email provider Mail.ee targeting a small number of accounts belonging to "persons of interest."
Political affairs
Since May 11, high-performance computing (HPC) services in several European countries have reported
Cybercrime
temporary shutdowns of their systems due to breaches. The activity has been linked to cryptomining.
Technology
A cyberattack on Norfund, the Norwegian government fund for developing countries, led to the transfer of
Cyberattacks
$10 million to an account controlled by cybercriminals.
Fraud
The largest European private hospital operator, Fresenius, suffered a ransomware attack that affected its IT
Cyberattacks
systems.
Healthcare
The airline EasyJet suffered a cyber-breach resulting in the leak of email addresses and travel details of
Cyberattacks
approximately 9 million customers.
Airlines
The UK Energy company Elexon experienced a cyberattack leading to the disruption of its IT network and
Cyberattacks
preventing the use of employee laptops.
Energy
The French newspaper Le Figaro exposed more than 7,4 billion records, including readers' personal, data due
Accidental
to a technical error.
Personal data
World
The US and the UK have issued alerts regarding Chinese targeting of organisations conducting COVID-19 Cyberespionage
research, in particular those involved in the search for a vaccine.
COVID-19
Recent intrusions at the WHO and a major US pharmaceutical company have been attributed to the Iranian-
Cyberespionage
nexus APT35 group.
Health
The popular messaging and social media platform WeChat, of Chinese origin, contains communication Cyberespionage
surveillance features that also work on content shared by international users.
Social media
The Chinese-nexus APT15 (also known as Ke3chang) has developed new malware dubbed Ketrum by Cyberespionage
merging features and code from their Ketrican and Okrum backdoors.
A hacker claimed a breach of Microsoft’s Github account, accessing 500GB of internal code. Microsoft later
Cybercrime
confirmed the breach. The same actor started trading stolen data from at least 11 companies.
Leaks
Recent research has uncovered a new Emotet module that attempts to spread over WiFi networks. It
enumerates wireless networks within its range and then tries to guess or crack their passwords.
Cybercrime
The highly organised, Russian-speaking cybercrime entity Netwalker is bringing together many recently
Cybercrime
emerged TTP trends and combining them into an efficient union of advanced crimeware.
In a tit-for-tat reaction, Israel has highly likely conducted a cyber operation against the Iranian port of Hormuz
Cyberwar
that resulted in disruption of its services. This was in response for alleged Iranian attempts to disrupt Israeli
Transport
water services.
Water
Taiwanese authorities believe that the ransomware attack on a state oil company was a mainland Chinese
Cyberwar
operation by actors operating under the Winnti Umbrella group.
Ransomware
Researchers of the security company Checkpoint reported on a novel attack technique targeting corporate
Cyberattacks
environments using an unspecified mobile device management (MDM) system.
Corporate IT
Researchers from the Carnegie Mellon University analysed about 200 million tweets discussing COVID-19
Disinformation
since January and concluded that about 45 percent of all involved Twitter accounts were likely automated.
COVID-19
Apple iOS v.13 has been described as “full of exploits” by the exploit broker Zerodium that lowered the prices
Vulnerabilities
offered for discovered issues.
IT
CERT-EU, CERT for the EU Institutions, Bodies and Agencies
Page 1 of 2
https://cert.europa.eu / xxxxxxxx@xxxx.xxxxxx.xx
Threat statistics
(May 2020)
Threat categories
Affected regions
2%
4%
3%
Africa
5%
7%
Asia
1%
Europe
5%
Latin America
24%
30%
Middle East
5%
49%
North America
Oceania
Cybercrime
Espionage
6%
Cyberwar
Hacktivists
5%
26%
Censorship
Sovereignty
30%
Vulnerability
Accidental
Top 10 affected sectors
Top 10 malware families
5%
6%
18%
Health
1
Mofksys
6%
2
UrSnif
Digital services
8%
3
Qbot
Government,
Administration
4
DanaBot
15%
Finance
8%
5
GandCrab
Technology
6
Kovter
IT
7
Agent Tesla
9%
15%
Telecoms
8
Emotet
11%
9
Tinba
Transport
10
NjRAT
CERT-EU, CERT for the EU Institutions, Bodies and Agencies
Page 2 of 2
https://cert.europa.eu / xxxxxxxx@xxxx.xxxxxx.xx
