{"id":28337,"date":"2019-05-24T09:33:37","date_gmt":"2019-05-24T15:33:37","guid":{"rendered":"https://www.webroot.com/blog/?p=28337"},"modified":"2019-05-24T09:33:39","modified_gmt":"2019-05-24T15:33:39","slug":"cyber-news-rundown-banking-trojan-closes-ohio-schools","status":"publish","type":"post","link":"https://www.webroot.com/blog/2019\/05\/24\/cyber-news-rundown-banking-trojan-closes-ohio-schools\/","title":{"rendered":"Cyber News Rundown: Banking Trojan Closes Ohio Schools"},"content":{"rendered":"\n<h2>Banking Trojan Shuts Down Ohio School District<\/h2>\n\n\n\n<p>After the discovery of the banking Trojan known as <a href=\"https:\/\/www.zdnet.com\/article\/ohio-school-sends-students-home-because-of-trickbot-malware-infection\/\">Trickbot<\/a>,\nan Ohio school district was forced to cancel school since they were unable to\nfully disinfect the networks before classes resumed the following Monday.\nPreliminary reports have concluded that no students were responsible for the\nattack, as it appears to have started its data-gathering on a computer\nbelonging to the district treasurer\u2019s office. In order for classes to resume\nnormally, the IT staff for the district had to re-format nearly 1,000 affected computers.&nbsp; <\/p>\n\n\n\n<h2>GetCrypt Spreading Through RIG Exploit Kits<\/h2>\n\n\n\n<p>Another <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/getcrypt-ransomware-brute-forces-credentials-decryptor-released\/\">ransomware\nvariant<\/a>, GetCrypt, has been spotted in the\nwild that spreads itself across systems by redirecting visitors to a\ncompromised website to a separate page hosting an exploit kit. After checking\nfor several Eastern European languages, the ransomware begins encrypting all\nfiles on the system and displays a standard ransom note. In addition to\nremoving all available shadow copies from the computer, GetCrypt also appends\nall encrypted files with a randomized, four-character string based on the CPUID\nof the device itself. <\/p>\n\n\n\n<h2>Google Assistant Logs All Online Purchases<\/h2>\n\n\n\n<p>It was recently discovered that <a href=\"https:\/\/www.zdnet.com\/article\/google-uses-gmail-to-track-everything-you-buy-online\/\">Google\u2019s\nAssistant<\/a>, released last year, keeps a log of all online purchases for\nwhich a receipt was sent to the user\u2019s Gmail account. The \u201cPayments\u201d page on a\nuser\u2019s Google account shows transactions, flight and hotel reservations, and\nother purchases made up to several years prior, even showing the cost, date,\nand time of the purchase. <\/p>\n\n\n\n<h2>Forbes Joins List of Magecart Victims<\/h2>\n\n\n\n<p>It was revealed late last week that <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/forbes-up-then-down-again\/\">Forbes<\/a>\nhad fallen victim to a Magecart attack possibly affecting anyone who made a\npurchase on the site during that time. Fortunately, the researcher who\ndiscovered the attack quickly notified both Forbes and the domain owner,\nresulting in a swift removal of the malicious payment card skimmer from the\nhighly-trafficked site. It\u2019s likely that Forbes became a victim after another vendor\nin their supply chain was compromised. <\/p>\n\n\n\n<h2>Australian IT Contractor Arrested for Cryptomining<\/h2>\n\n\n\n<p>An IT contractor working in Australia was arrested after\nbeing caught running <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/contractor-faces-jail-for-using-govt-servers-for-cryptomining\/\">cryptomining<\/a>\nsoftware on government-owned computers, which netted him over $9,000 in\ncryptocurrency. The charges encompass misuse of government systems by making modifications\nto critical functions and security measures for personal gain while in a\nposition of trust. By making these changes, this contractor could have exposed\na much larger portion of the network to malicious actors who take advantage of\nmisconfigured settings to access company data.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Banking Trojan Shuts Down Ohio School District After the discovery of the banking Trojan known as Trickbot, an Ohio school district was forced to cancel school since they were unable to fully disinfect the networks before classes resumed the following Monday. Preliminary reports have concluded that no students were responsible for the attack, as it [&hellip;]<\/p>\n","protected":false},"author":47,"featured_media":28339,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[21935,21936,21940],"yst_prominent_words":[3563,6423,6409,3453,5409,19705,4905,4169,25261,3937,18743,19703,4143],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/28337"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/47"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=28337"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/28337\/revisions"}],"predecessor-version":[{"id":28341,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/28337\/revisions\/28341"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/28339"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=28337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=28337"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=28337"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=28337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}