Indonesian election. Malware in Pakistan. RAT hunt. Breaching clouds. 0-day exploits. Operation Sheep. DGAs vs. points-of-sale.

Indonesian authorities say, according to Reuters, that voting will go on as planned, that the government can handle any disruptions, and that, while there have been "probes" from a range of foreign IP addresses (including Russia and China, but not limited to these two) domestic finagling is probably more prevalent than any foreign influence attempts.

Trustwave warns of compromised Pakistani government sites serving keyloggers.

A significant number of attacks against corporate data are traceable to remote-access Trojans (RATs), many of which represent commodity malware traded in the criminal underground. Recorded Future today published an overview of RAT activity.

Proofpoint outlines how threat actors breach cloud accounts.

Kaspersky reports that a zero-day Microsoft patched this week, CVE 2019-0797, is being actively exploited by two espionage APTs, SandCat and FruityArmor. SandCat also uses CHAINSHOT malware and FinFisher/FinSpy.

Researchers at Check Point describe "Operation Sheep," in which Chinese IT and services firm Hangzhou Shunwang Technology is apparently scraping data (contact lists, geolocation, and QQ messenger login information) from Android phones via some twelve Android apps infected through a data analytics software development kit. The applications are available through third-party stores and seem mostly to affect users in China. Check Point thinks the app developers and the stores have been unaware of the data collection campaign.

Flashpoint researchers note an unusual point-of-sale campaign that's targeted mainly small and medium-sized businesses: DMSniff creates command-and-control domains using a domain generation algorithm. This makes the malware more resistant to domain takedowns by police or tech service providers.