Security researchers discovered that a group of hackers breached multiple banks in 25 plus countries worldwide, including Bangladesh, India, Sri Lanka, and Kyrgyzstan.

According to the research firm Group-IB, a hacker group named Silence is likely behind the recent cyber-attack on the Dutch Bangla Bank Limited in Bangladesh. The attackers apparently scooped more than $3 million in an ATM cash-out attack that occurred in May 2019, the ZDNet reported.

Group-IB stated the Silence group has been active since 2016 and previously attacked banks in Russia, former Soviet states, and Eastern Europe. It’s said that the hacker group appears to have deployed a malicious code, named Silence malware, on the bank’s network to run malicious commands on hosts and allegedly used the access to orchestrate fund withdrawals from the bank’s ATMs, according to the security researcher Rustam Mirkasymov at Group-IB.

“Group-IB has the ability to actively track cybercriminals’ infrastructure of this and other financially motivated cybercriminal groups. This all gives us visibility to indefinitely confirm that an infected machine inside the bank’s network was communicating with Silence’ infrastructure,” said Mirkasymov. “In this case, we discovered that Dutch Bangla Bank’s hosts with external IPs 103.11.138.47 and 103.11.138.198 were communicating with Silence’s C&C (185.20.187.89) since at least February 2019.”

Describing the hacker group Dmitry Volkov, the Chief Technology Officer and Head of Threat Intelligence at Group-IB, said, “It appears that the cybercriminals responsible for these crimes were at some point active in the security community. Either as penetration testers or reverse engineers. They carefully study the attacks conducted by other cybercriminal groups and analyze antivirus and Threat Intelligence reports. Many of Silence’s tools are legitimate, others they developed themselves and learn from other gangs. The Internet, particularly the underground web, favors this kind of transformation; it is now far easier to become a cybercriminal than 5–7 years ago.”

Multiple banks and other financial companies in several West African countries have suffered from different hacking attacks, which are underway since mid-2017. According to a report published by Symantec, financial institutions in Cameroon, Congo (DR), Equatorial Guinea, Ghana, and the Ivory Coast have been hit by multiple cyber-attacks in 2017 and 2018. Symantec stated the intruders who are behind these attacks were unknown.

Symantec stated that it has detected four distinct hacking campaigns targeted against financial firms in Africa. The first attack started in mid-2017 and has infected computers with a malware known as NanoCore (Trojan.Nancrat). The second type of attack began in late 2017, in which cybercriminals used malicious PowerShell scripts and credential-stealing tool Mimikatz (Hacktool.Mimikatz) to exploit their targets.

The third attack was targeted at banks in Ivory Coast using a malware called Remote Manipulator System RAT (Backdoor.Gussdoor), alongside Mimikatz and two custom Remote Desktop Protocol (RDP) tools. The fourth attack started in December 2018. The intruders used a malware known as Imminent Monitor RAT (Infostealer.Hawket) to attack banks in Ivory Coast. Symantec stated that all the four attacks were discovered through alerts generated by its Targeted Attack Analytics (TAA), which uses artificial intelligence to analyze and spot targeted attacks.

The U.S. Cyber Command has issued a public warning to users, companies, and government agencies stating that it is has discovered an “active malicious use” of a vulnerability in Microsoft Outlook that seems to be linked to Iran-backed attackers. The agency stated the attackers might exploit the flaw in the Outlook mail client to turn off security features and gain access to users’ credentials.

“USCYBERCOM has discovered active malicious use of CVE-2017-11774 and recommends immediate patching,” the agency said in a Twitter post.

The Cyber Command suggested the users update their unpatched Outlook versions to prevent potential cyber-attacks. The warning comes after the recent reports that Iran and the U.S. are involving in offensive cyber campaigns.

Recently, the Military cyber forces of the United States launched a cyber-attack against Iranian Military computer systems in response to Iran’s shootdown of $240 million worth U.S. surveillance drone. The attack was performed with the approval from the President Donald Trump.

The attack was targeted on the Iranian military computers that used to control the entire Iran missile operations. According to the Islamic Revolutionary Guard Corps, the drone was taken down when it entered Iran’s airspace near the Kouhmobarak district in the south of Hormuz.

“The downing of the American drone was a clear message to America … our borders are Iran’s red line and we will react strongly against any aggression … Iran is not seeking war with any country, but we are fully prepared to defend Iran,” the Revolutionary Guard commander, Hossein Salami, said in a media statement.

However, the U.S. Air Force denied Iran’s argument. “This was an unprovoked attack on a U.S. surveillance asset that had not violated Iranian airspace at any time during its mission,” said General Joseph Guastella. “This attack is an attempt to disrupt our ability to monitor the area following recent threats to international shipping and the free flow of commerce. The aircraft was over the Strait of Hormuz and fell into international waters.”

Recently, the cybersecurity research firm FireEye claimed that an undetected hackers’ group from Iran is allegedly stealing travel and mobile data of individuals in the Middle East region. According to FireEye, the Iranian group dubbed APT39 has targeted several people in the Middle East, especially in the Gulf region. It’s believed that the espionage group is allegedly providing information to the Iranian government. The researchers at FireEye stated that they had been tracking APT39 activities since 2014 to protect organizations from cyber incidents.

With an aim to enhance the cybersecurity posture of the state, Indiana University has announced the launch of a new Cybersecurity Clinic.

The University stated the new clinic will serve as a cybersecurity hub for training and address security issues encountered by governments, businesses, and individuals. The Clinic also helps not-for-profit organizations and small businesses better manage cyber-attacks, protect intellectual property, and improve data privacy.

The new cybersecurity clinic, worth of $340,000, will work along with students from across the university, including the Kelley School of Business, the Maurer School of Law, and the School of Informatics, Computing, and Engineering.

“As Indiana continues to establish a strategic framework of cybersecurity initiatives, we’re committed to taking an all-hands-on-deck approach that combines the cyber expertise and leadership of our universities, research centers and businesses,” said Dave Roberts, chief innovation officer at the Indiana Economic Development Corp. “We’re excited to contribute to the launch of the new IU Cybersecurity Clinic, which will offer next-generation training and real-world experience for Hoosier students while assisting organizations in instilling an array of cybersecurity best practices and expanding Indiana’s cybersecurity professional workforce that will be integral to powering our economy into the 21st century.”

Three Universities in the United States have recently disclosed data breach incidents that exposed personally identifiable information of students and working staff. The three universities, Graceland University, Oregon State University, and Missouri Southern State University, stated that unknown intruders made unauthorized access to some of their employees’ email accounts.

The exposed information included, students’ full name, social security number, date of birth, address, telephone number, email address, parents/children, salary information, and financial aid information for enrollment.

The students and employees whose personal information was potentially stolen or accessed in the incident have been notified. The security professionals at the universities clarified that no evidence has been found of the impacted personal information being stolen or used in a malicious manner.

Recently, the Australian National University discovered a major data breach that affected students’ and University’s sensitive information. According to the University’s Vice-Chancellor Brian Schmidt, unknown cybercriminals attacked University’s systems and accessed personal information late in 2018, which was recently discovered by the University authorities on May 17, 2019. It’s believed that the hackers had unauthorized access to 19 years of significant amounts of information related to personal staff, students, and visitors.

The Austrian Financial Market Authority (FMA), the country’s financial regulator, stated that the banks in Austrian were found to be well prepared to defend themselves from evolving cyber threats after it staged the first Cyber War Game in the country. The cybersecurity test was launched on 10 banks, their IT providers, the Austrian Computer Emergency Response Team, and the interior ministry.

The one-day Cyber War Game exercise, consisted of 170 fake attacks launched by 100 experts, is intended to test the security levels of banks, technology providers, public authorities, and other financial organizations in the country. The fake cyber-attacks included malicious software injection, Phishing attacks and attacks that targeted system software and online banking apps as well as the shutdown of ATMs and websites, according to FMA.

“The organizational designs have shown to be very diverse,” FMA co-heads Helmut Ettl and Klaus Kumpfmueller said in a media statement. “The results will now be analyzed in detail and the consequences will be implemented in supervisory and regulatory activity.”

Recently, multiple banks and other financial companies in several West African countries have suffered from different hacking attacks, which are underway since mid-2017. According to a report published by Symantec, financial institutions in Cameroon, Congo (DR), Equatorial Guinea, Ghana, and the Ivory Coast have been hit by multiple cyber-attacks in 2017 and 2018. Symantec stated the intruders who are behind these attacks were unknown.

Symantec stated that it has detected four distinct hacking campaigns targeted against financial firms in Africa. The first attack started in mid-2017 and has infected computers with a malware known as NanoCore (Trojan.Nancrat). The second type of attack began in late 2017, in which cybercriminals used malicious PowerShell scripts and credential-stealing tool Mimikatz (Hacktool.Mimikatz) to exploit their targets.

The third attack was targeted at banks in Ivory Coast using a malware called Remote Manipulator System RAT (Backdoor.Gussdoor), alongside Mimikatz and two custom Remote Desktop Protocol (RDP) tools. The fourth attack started in December 2018. The intruders used a malware known as Imminent Monitor RAT (Infostealer.Hawket) to attack banks in Ivory Coast. Symantec stated that all the four attacks were discovered through alerts generated by its Targeted Attack Analytics (TAA), which uses artificial intelligence to analyze and spot targeted attacks.

Security researchers have revealed that the Indian manufacturing industry is currently facing severe cybersecurity risks. According to a survey from cybersecurity firm Seqrite, the manufacturing sector in India accounted for more than 27 percent of the threats detected between January and March 2019. Seqrite, an enterprise arm of Quick Heal technologies, is a specialist provider of endpoint security, network security, enterprise mobility management, and data protection solutions.

In its research report, named Threat Report Q1 2019, Seqrite highlighted that many of the IoT devices used by manufacturers like sensors, barcode readers, quality control systems, inventory management solutions, etc. come with minimal security, giving an avenue to cybercriminals to attack and infiltrate the enterprise network.

The survey also stated the manufacturers with inadequate cybersecurity measures might be an easy target for attackers, causing potential risk to their intellectual properties (IP) such as new technologies, products, confidential designs and formulas.

Apart from the manufacturing industry, the other sectors which were at high risk from cyber threats are enterprises in industries such as Professional Services (22.59 percent) and Education (14.64 percent), according to the report.

“Over the years, manufacturers across India have invested heavily to secure themselves against physical intrusions and damages. However, ensuring robust digital security for their IT systems as well as the connected devices used in manufacturing processes has remained quite low on the list of priorities,” said Sanjay Katkar, Joint Managing Director and Chief Technology Officer at Quick Heal.

“Indian manufacturing sector is vulnerable to threats from cyber-criminals looking to make financial gains, corporate espionage by competitors looking to gain competitive advantage, and/or state-sponsored threat actors looking to cause widespread economic disruption,” Katkar added.

A similar research revealed that the gaming industry has become an attractive target for cybercriminals with 12 billion credential stuffing attacks reported in the past 17 months (November 2017-March 2019). According to the Cloud delivery network provider Akamai Technologies, the gaming community is among the most lucrative targets for hackers to make a quick profit. In its research report, “2019 State of the Internet/Security Web Attacks and Gaming Abuse” Akamai stated that there were 55 billion cases of credential stuffing attacks across all industries.

The report highlighted that nearly 67% of credential stuffing attacks target organizations based in the United States. It stated that Russia is the second largest source of application attacks and China is ranked as the fourth highest source country. On the other hand, the United Kingdom ranked as the second highest targeted country with Japan, Canada, Australia, and Italy are all also among the countries most targeted.