--- title: "Cyber Security News Update, Week 18 of 2021 | DuoCircle" description: "The bygone week in cybersecurity is full of exciting incidents like threat actors hiding from ransomware protection tools." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-18-of-2021/" --- Quick Answer Cybersecurity stories from the week of May 3, 2021: researchers warned that ransomware operators were adopting more sophisticated evasion against endpoint protection, including living-off-the-land binaries and disabling security tools before encryption. Chinese WeChat users received messages carrying malicious JavaScript payloads. A 'WhatsApp Pink' fake update circulated, hijacking accounts when installed. The AppleJeus malware, attributed to North Korea's Lazarus group, returned with new fake cryptocurrency apps. The BRATA banking trojan reappeared on Google Play disguised as app-security scanners. And attackers were observed using Telegram channels and Google Forms as cheap, hard-to-block command-and-control and data-exfiltration channels. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-18-of-2021%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Cyber%20Security%20News%20Update%2C%20Week%2018%20of%202021&url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-18-of-2021%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-18-of-2021%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-18-of-2021%2F&title=Cyber%20Security%20News%20Update%2C%20Week%2018%20of%202021 "Share on Reddit") [ ](mailto:?subject=Cyber%20Security%20News%20Update%2C%20Week%2018%20of%202021&body=Check out this article: undefined%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-18-of-2021%2F "Share via Email") ![Cyber Security](https://media.mailhop.org/duocircle/images/2021/04/SMTP-relay-8613.jpg) The bygone week in cybersecurity is full of exciting incidents like threat actors hiding from [ransomware protection](https://www.phishprotection.com/products/advanced-threat-defense/) tools. Read on to find the latest updates from the cyber world ## Sophisticated Ransomware Attacks On The Way The strategies threat actors employee is getting sophisticated with time and a panel of IT experts emphasized this at the 2021 Incident Response Forum Masterclass. They said that apart from double extortion technique, and cartel formation, adversaries employ other technical strategies to pressurize victims. These include Active Directory compromises (as in the SolarWinds attack) where _attackers stay within a compromised system or a long time looking for all [connected systems](https://web.archive.org/web/20230520000429/https://cyware.com/news/new-tactics-provide-invisibility-cloak-to-ransomware-attacks-ddefb7ab) that they can hack_. _The adversaries often encrypt the whole virtual machine environment to delay the forensic analysis_. Their copying methods have improved; they now use open-source tools, like Rclone, instead of traditional tools like Megaupload or FileZilla to quicken the process and leave behind a minimal footprint. Since the attacking techniques aren’t getting any simpler, it’s time for us to strengthen our [ransomware protection](https://www.phishprotection.com/products/advanced-threat-defense/) strategies! ## Chinese WeChat Users Receive Malicious JavaScript Code _Cyber attackers are using a Chrome exploit published recently to target Chinese WeChat users_. The users receive an infected link on WeChat opening, which loads and executes a [malicious JavaScript code](https://therecord.media/recent-chromium-bug-used-to-attack-chinese-wechat-users/?web%5Fview=true) on their operating systems. However, _WeChat Windows app users are vulnerable to this attack scheme_. The attackers are leveraging on the **proof-of-concept code** of two bugs in the Chromium browser engine. WeChat Windows uses this code to open links without a separate browser, and the adversaries connivingly used the post on Twitter and GitHub to their benefit. _They were able to run malicious code in all Chromium-based browsers using this proof-of-concept code_. However, the exploit code couldn’t infect many browsers because most of them had enabled the **sandbox security** feature to act as a cybersecurity measure and prevent malicious code from infecting the operating system. Experts have warned that the proof-of-concept code continues to be a threat for all Chromium projects without sandbox protection. _The good thing is that the WeChat developer (Tencent) has been updated about the security flaws_, and it has updated the new Chromium patches. [![ ransomware protection](https://media.mailhop.org/duocircle/images/2021/04/SMTP-relay-8612.jpg)](https://media.mailhop.org/duocircle/images/2021/04/SMTP-relay-8612.jpg) ## Why Isn’t Turning You Whatsapp Pink A Good Idea? Any new WhatsApp update is usually fun and exciting, but this message circulated on Whatsapp downloads an [auto-reply worm](https://www.bleepingcomputer.com/news/security/whatsapp-pink-malware-can-now-auto-reply-to-your-signal-telegram-texts/?&web%5Fview=true) instead of the promised ‘WhatsApp Pink.’ Distributed over a Whatsapp forward, the link to WhatsApp Pink leads users to a page that downloads the WhatsApp Pink APK. _WhatsApp Pink is a variant of a fake Huawei app discovered earlier this year_. This WhatsApp **auto-reply worm** replies to messages received on all instant messaging apps such as Telegram, Signal, Skype, and Viber. Cybersecurity tools may not detect the WhatsApp Pink app on a device because it disappears after being downloaded and works in the background. _The worst part is that even WhatsApp’s end-to-end encryption cannot stop auto-replies by the WhatsApp Pink APK_ because it is one of the ‘end’ devices that the adversaries compromise in such attacks! Therefore, the safest thing would be not downloading the WhatsApp Pink app, and in case you have already downloaded it, you should go to your settings, _restrict all permissions to the app and delete it_. Consider scanning your device with an **antivirus solution** for security! ## Applejeus Makes A Comeback _The North-Korean state-sponsored threat actor Lazarus group is infamous for its malicious attacks_. It hits the cybersecurity headlines again this week for reviving the AppleJeus malware it used in February this year to target Mac devices. The Lazarus or Hidden Cobra group now uses AppleJeus to attack cryptocurrency exchanges, financial services, and others. They are propagating the malware through malicious crypto trading apps. Keeping in mind the relentless attacks launched by the Lazarus group in the past, the FBI and CISA have released a joint advisory that provides organizations with proactive **email protection** measures. They recommend enterprises adopt cybersecurity measures beforehand to mitigate risks associated with AppleJeus. ## BRATA Apps Circulating As App Security Scanners On Google Play Store News of malicious apps being available on the Google Play Store has startled us time and again. But this time, some malicious apps are impersonating app security scanners, making it very difficult for unsuspecting users even to guess the prospects of the app being fake! _These so-called app security scanners are new strains of the Brazilian Remote Access Tool Android (BRATA) malware family_. The BRATA apps have been downloaded **over 1000 times** in the U.S, Brazil, and Spain and _spread a backdoor that steals confidential info_. In addition to BRATA, DefenseScreen (another corrupt app) was downloaded over 10,000 times before Play Store brought it down. Since these malicious apps can easily pass for genuine ones, it is wise to take cybersecurity measures from our end and remember that Play Store auto-updates them, and we do not need to grant permission to third parties for the same. [![phishing attack](https://media.mailhop.org/duocircle/images/2021/04/SMTP-relay-8611.jpg)](https://media.mailhop.org/duocircle/images/2021/04/SMTP-relay-8611.jpg) ## Telegram And Google Forms Are The New Attack Tools When we think the cyber adversaries have exhausted their stock of ideas on **stealing user data**, they come up with new online scams. _This latest one uses Telegram and Google Forms to curate data stolen from_ [_phishing attacks_.](https://web.archive.org/web/20240704113456/https://cyware.com/news/cybercriminals-use-telegram-bots-and-google-forms-for-automated-phishing-6bdaba1e) They combine this accumulation of stolen data with automated **phishing platforms** that are readily available on the dark web as Telegram bots. Such cybercrime-as-a-model attacks are increasing rapidly. _Phishing kits targeted over 260 brands in 2020_. Cybersecurity tools often miss these attacks because of the automated attacks and instant replacements for blocked websites that characterize phishing kits. ## Topics NewsSecurityUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-18-of-2021%2F) [ ](https://twitter.com/intent/tweet?text=Cyber%20Security%20News%20Update%2C%20Week%2018%20of%202021&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-18-of-2021%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcyber-security-news-update-week-18-of-2021%2F) Copy Related Articles - [ ![spam](https://media.mailhop.org/duocircle/images/2021/07/sender-policy-framework-7535.jpg) Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam News ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/) - [ ![Cyber Security](https://media.mailhop.org/duocircle/images/2022/01/spf-flattening-7011.jpg) Cyber Security News Update, Week 1 of 2022 News ](/blog/announcements/cyber-security-news-update-week-1-of-2022/) - [ ![Cybersecurity](https://media.mailhop.org/duocircle/images/2023/01/spf-validator-6824.jpg) Cybersecurity News Update, Week 1 of 2023 News ](/blog/announcements/cyber-security-news-update-week-1-of-2023/) - [ ![cybersecurity](https://media.mailhop.org/duocircle/images/2024/01/phishing-protection.jpg) EasyPark Data Breach, Ohio Lottery Cyberattack, GTA 5 Leak, Cybersecurity News \[December 25, 2023\] News ](/blog/announcements/cyber-security-news-update-week-1-of-2024/) ## Related Articles [ News 3m Alert: Fix SPF & DKIM Settings For Your Email Forwarding Set Up Through Microsoft o365 SMTP Server Or Your Emails May End Up In Spam Jul 20, 2021 ](/blog/announcements/alert-fix-spf-dkim-settings-for-your-email-forwarding-set-up-through-microsoft-o365-smtp-server-or-your-emails-may-end-up-in-spam/)[ News 6m Cyber Security News Update, Week 1 of 2022 Jan 7, 2022 ](/blog/announcements/cyber-security-news-update-week-1-of-2022/)[ News 7m Cybersecurity News Update, Week 1 of 2023 Jan 1, 2023 ](/blog/announcements/cyber-security-news-update-week-1-of-2023/)[ News 5m EasyPark Data Breach, Ohio Lottery Cyberattack, GTA 5 Leak, Cybersecurity News \[December 25, 2023\] Jan 4, 2024 ](/blog/announcements/cyber-security-news-update-week-1-of-2024/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Cyber Security News Update, Week 18 of 2021","description":"The bygone week in cybersecurity is full of exciting incidents like threat actors hiding from ransomware protection tools.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-18-of-2021/","datePublished":"2021-04-26T21:34:55.000Z","dateModified":"2025-05-20T16:05:58.000Z","dateCreated":"2021-04-26T21:34:55.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-18-of-2021/"},"articleSection":"announcements","keywords":"News, Security, Updates","wordCount":918,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2021/04/SMTP-relay-8613.jpg","caption":"Cyber Security","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"News"},{"@type":"ListItem","position":3,"name":"Cyber Security News Update, Week 18 of 2021","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-18-of-2021/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"News","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Cyber Security News Update, Week 18 of 2021","item":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-18-of-2021/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Cyber Security News Update, Week 18 of 2021","description":"The bygone week in cybersecurity is full of exciting incidents like threat actors hiding from ransomware protection tools.","url":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-18-of-2021/","datePublished":"2021-04-26T21:34:55.000Z","dateModified":"2025-05-20T16:05:58.000Z","dateCreated":"2021-04-26T21:34:55.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cyber-security-news-update-week-18-of-2021/"},"articleSection":"announcements","keywords":"News, Security, Updates","wordCount":918,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2021/04/SMTP-relay-8613.jpg","caption":"Cyber Security","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```