At a glance.
- Allianz Life breach reportedly affected over a million customers.
- Researcher discovers website flaws exposing data on all Intel employees.
- DPRK-aligned spearphishing campaign targets embassies.
Allianz Life breach reportedly affected over a million customers.
Have I Been Pwned has disclosed that a cyberattack against US insurance firm Allianz Life last month breached data belonging to 1.1 million customers, exposing names, addresses, phone numbers, and email addresses, Reuters reports. An Allianz Life spokesperson declined to comment on the ongoing investigation, but the company previously confirmed that the incident affected a majority of its 1.4 million customers.
BleepingComputer says the breach was part of a wave of social engineering attacks by the ShinyHunters extortion group targeting organizations' Salesforce instances.
Researcher discovers website flaws exposing data on all Intel employees.
Security researcher Eaton Z discovered flaws in four of Intel's websites that allowed the researcher to download information on every Intel employee, Tom's Hardware reports. In one case, the researcher was able to bypass the login for a website operated by Intel India designed for employees to create their own business cards. Once inside, a user could return information on more than 270,000 Intel employees and workers worldwide. Other flaws affecting internal Product Hierarchy and Product Onboarding websites exposed data on all Intel employees. Another vulnerability in the company's SEIMS Supplier Site "made it possible to gain full access to the system to view large amounts of confidential information about Intel’s suppliers."
Intel acknowledged that it received the researcher's report, and the sites have since been secured.
DPRK-aligned spearphishing campaign targets embassies.
Trellix is tracking a North Korea-aligned spearphishing campaign targeting European embassies and foreign ministries in Seoul. The phishing emails contained PDF attachments designed to deliver the XenoRAT malware, leveraging the GitHub API for command-and-control.
The operation overlaps with previous activity by North Korea's Kimsuky APT, but the researchers note timing patterns that suggest the threat actor is based in China. Trellix says this "could indicate either North Korean operatives working from Chinese territory, a Chinese APT operation mimicking Kimsuky techniques, or a collaborative effort leveraging Chinese resources for DPRK intelligence objectives." The researchers attribute the campaign to Kimsuky, but assess with "medium-confidence that the operators are operating from China or are culturally Chinese."
