The Research Wing at CyberPeace Foundation has come across some links via Whatsapp related to Year-end carnival pretending to be an offer from Flipkart.

BLUE KEEP (CVE-2019-07/08) is a critical remote code execution vulnerability in Remote Desktop Protocol Service. This vulnerability is pre-authentication and does not require any user interaction to spread. It spreads rapidly in a worm-like fashion thus making it extremely critical. Worldwide millions of users use RDP service for remote controlled administration.

This observations report is a summary of an investigative research conducted by Nitish Chandan from Cyber Peace Foundation. It explores the proliferation of several types of unlawful content and activity through a live streaming app; paving way for several violations of the law and harmful impact on the society at large.

Cyber fraudsters use COVID-19 pandemic opportunity to spread phishing emails, and malicious links disguise as Corona related information and updates. The suspicious links can be considered under categories of malicious links to spread Malware, Adware and Phishing related links. Identification and suspension of these links would be of utmost priority for a proactive cybersecurity mechanism. With this objective, the set of a malicious URL was identified and processed further. The collection of the malicious links identified are 503 links.

Cyber attacks on healthcare facilities have been rising in recent years, and the pandemic has only worsened matters. With hospitals and other healthcare facilities struggling to keep up with the demand for care, they have become an easy target for cybercriminals. While this may seem like a small amount, it can be devastating for a hospital that is already stretched thin.

After an initial report about chat groups on WhatsApp being used to disseminate and share CSAM, the applications hosting invite links to these groups were removed from the Play Store by Google in December. This, however, did not stop the apps or the promulgation of content which was reported in our report earlier. Platforms have since then started adopting sophisticated technology and removed thousands of accounts that were found to be disseminating CSAM but in a follow up investigation, it was found that groups are still being created regularly and active solicitation is also happening.

The campaign appears to be an offer from the State Bank of India, but it is hosted on a third-party domain instead of the official State Bank of India website, raising suspicion. Cybercriminals utilised Google's Firebase technology to disseminate the Malicious application on Cyberspace.

One of the CyberPeace Corps Volunteers has asked the Research Wing of CyberPeace Foundation to initiate an investigation on a link which asks users which claims users can earn more than INR 100000 by UOB investment in India. The Research Wing of CyberPeace Foundation along with Autobot Infosec Private Limited have looked into this matter to reach a conclusion that the campaign is either legitimate or an online fraud.

The campaign is pretended to be an offer from TATA but is hosted on the third-party domain instead of the official TATA website which makes it more suspicious. The domain names associated with the campaign have been registered in very recent times. Multiple redirections have been noticed between the links. No reputed site would ask its users to share the campaign on WhatsApp.

The Research Wing at CyberPeace Foundation has come across some links via Whatsapp related to Year-end carnival pretending to be an offer from Flipkart.

BLUE KEEP (CVE-2019-07/08) is a critical remote code execution vulnerability in Remote Desktop Protocol Service. This vulnerability is pre-authentication and does not require any user interaction to spread. It spreads rapidly in a worm-like fashion thus making it extremely critical. Worldwide millions of users use RDP service for remote controlled administration.

This observations report is a summary of an investigative research conducted by Nitish Chandan from Cyber Peace Foundation. It explores the proliferation of several types of unlawful content and activity through a live streaming app; paving way for several violations of the law and harmful impact on the society at large.

Cyber fraudsters use COVID-19 pandemic opportunity to spread phishing emails, and malicious links disguise as Corona related information and updates. The suspicious links can be considered under categories of malicious links to spread Malware, Adware and Phishing related links. Identification and suspension of these links would be of utmost priority for a proactive cybersecurity mechanism. With this objective, the set of a malicious URL was identified and processed further. The collection of the malicious links identified are 503 links.

Cyber attacks on healthcare facilities have been rising in recent years, and the pandemic has only worsened matters. With hospitals and other healthcare facilities struggling to keep up with the demand for care, they have become an easy target for cybercriminals. While this may seem like a small amount, it can be devastating for a hospital that is already stretched thin.

After an initial report about chat groups on WhatsApp being used to disseminate and share CSAM, the applications hosting invite links to these groups were removed from the Play Store by Google in December. This, however, did not stop the apps or the promulgation of content which was reported in our report earlier. Platforms have since then started adopting sophisticated technology and removed thousands of accounts that were found to be disseminating CSAM but in a follow up investigation, it was found that groups are still being created regularly and active solicitation is also happening.

The campaign appears to be an offer from the State Bank of India, but it is hosted on a third-party domain instead of the official State Bank of India website, raising suspicion. Cybercriminals utilised Google's Firebase technology to disseminate the Malicious application on Cyberspace.

One of the CyberPeace Corps Volunteers has asked the Research Wing of CyberPeace Foundation to initiate an investigation on a link which asks users which claims users can earn more than INR 100000 by UOB investment in India. The Research Wing of CyberPeace Foundation along with Autobot Infosec Private Limited have looked into this matter to reach a conclusion that the campaign is either legitimate or an online fraud.

The campaign is pretended to be an offer from TATA but is hosted on the third-party domain instead of the official TATA website which makes it more suspicious. The domain names associated with the campaign have been registered in very recent times. Multiple redirections have been noticed between the links. No reputed site would ask its users to share the campaign on WhatsApp.

On the landing page a Congratulations message appears with an attractive photo of a Tata car and asks users to participate in a quick survey in order to get a “Tata Nexon EV ". Also at the bottom of this page a section comes up which seems to be a comment section where many users have commented about how the offer is beneficial.

During the investigation on the site we found that it has XML-RPC enabled which might tend the site to be vulnerable with pingback attack and brute force attack via XML=-RPC. XML-RPC on WordPress is actually an API that allows developers who make 3rd party applications and services to have the ability to interact with the WordPress site. The XML-RPC API provides several key functionalities that include Publish a post, Edit a post. Delete a post, Upload a new file.

On the landing page an error related message “404 Page Not Found" appears which (error code 404) usually means the page is either removed or not available on the server.In source code analysis we found, the error message “404 Page Not Found, was created manually using html tag <h1> by the owner of the website.

The Research Wing at CyberPeace Foundation has come across some links via Whatsapp related to Year-end carnival pretending to be an offer from Flipkart.

BLUE KEEP (CVE-2019-07/08) is a critical remote code execution vulnerability in Remote Desktop Protocol Service. This vulnerability is pre-authentication and does not require any user interaction to spread. It spreads rapidly in a worm-like fashion thus making it extremely critical. Worldwide millions of users use RDP service for remote controlled administration.

This observations report is a summary of an investigative research conducted by Nitish Chandan from Cyber Peace Foundation. It explores the proliferation of several types of unlawful content and activity through a live streaming app; paving way for several violations of the law and harmful impact on the society at large.

Cyber fraudsters use COVID-19 pandemic opportunity to spread phishing emails, and malicious links disguise as Corona related information and updates. The suspicious links can be considered under categories of malicious links to spread Malware, Adware and Phishing related links. Identification and suspension of these links would be of utmost priority for a proactive cybersecurity mechanism. With this objective, the set of a malicious URL was identified and processed further. The collection of the malicious links identified are 503 links.

Cyber attacks on healthcare facilities have been rising in recent years, and the pandemic has only worsened matters. With hospitals and other healthcare facilities struggling to keep up with the demand for care, they have become an easy target for cybercriminals. While this may seem like a small amount, it can be devastating for a hospital that is already stretched thin.

After an initial report about chat groups on WhatsApp being used to disseminate and share CSAM, the applications hosting invite links to these groups were removed from the Play Store by Google in December. This, however, did not stop the apps or the promulgation of content which was reported in our report earlier. Platforms have since then started adopting sophisticated technology and removed thousands of accounts that were found to be disseminating CSAM but in a follow up investigation, it was found that groups are still being created regularly and active solicitation is also happening.

The campaign appears to be an offer from the State Bank of India, but it is hosted on a third-party domain instead of the official State Bank of India website, raising suspicion. Cybercriminals utilised Google's Firebase technology to disseminate the Malicious application on Cyberspace.

One of the CyberPeace Corps Volunteers has asked the Research Wing of CyberPeace Foundation to initiate an investigation on a link which asks users which claims users can earn more than INR 100000 by UOB investment in India. The Research Wing of CyberPeace Foundation along with Autobot Infosec Private Limited have looked into this matter to reach a conclusion that the campaign is either legitimate or an online fraud.

The campaign is pretended to be an offer from TATA but is hosted on the third-party domain instead of the official TATA website which makes it more suspicious. The domain names associated with the campaign have been registered in very recent times. Multiple redirections have been noticed between the links. No reputed site would ask its users to share the campaign on WhatsApp.