ECB's BIRD hacked. Evasive cryptominer. Intimations of trouble at Capital One. Instagram vs. fake news. Electric Fish exposed.

The European Central Bank closed down one of its websites yesterday after sustaining an unspecified cyberattack on the Banks' Integrated Reporting System (BIRD). Reuters reports that ECB says no "market-sensitive data" were compromised, but that email addresses, names, and titles of BIRD newsletter subscribers may have been taken.

The Norman cryptominer, tracked by Varonis, shows some unusual evasiveness. Its DLL arrives with the Agile obfuscator. The malware also injects an obfuscated miner into an appropriate application along its execution path, and it stops mining Monero when the infected user opens Task Manager.

The Wall Street Journal reports that employees at Capital One expressed concern over what they saw as high turnover among the bank's cybersecurity unit. There are reports that a third of the cybersecurity staff left in 2018. The unit was responsible for threat hunting, firewall configuration, and similar security tasks. Even given the turnover, Capital One points out that total cybersecurity headcount actually increased over that period. Nonetheless, insiders complained of a poor organizational climate, lax security oversight, and slow deployment of security tools.

Instagram is introducing a feature that will permit users to flag information they believe to be false. Reuters has an account of the tool, which appears to be an interim gesture in the direction of controlling fake news.

US Cyber Command has posted Electric Fish malware from North Korea's APT38 threat group to VirusTotal. FireEye has reported that APT38 is heavily involved in state-directed financial crime. Its activities overlap those of the Lazarus Group.