Threat Intelligence Bulletin: 06/12/2020 - 06/18/2020

Breach Disclosure: Foodora

The online food delivery service, Delivery Hero, has confirmed a breach impacting its Foodora brand. The breach contains data from 14 countries including personal details for 727,000 accounts, which contained names, addresses, phone numbers, hashed passwords, and coordinates of users.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This breach contains data all the way back from 2016, and from multiple countries which Foodora operated, including United Arab Emirates, Singapore, Germany, Spain, France, Liechtenstein, Italy, Austria, Hong Kong, the Netherlands, Canada, Sweden, Norway and Australia.

The breach contained multiple SQL files, broken up by countries, and included a Customer Address file, along with a Customer file. Luckily the passwords contained in the breached data were hashed using bcrypt, however, there were some MD5 hashes contained in the data, which could potentially be cracked relatively quicker than other hashing methods.

Delivery Hero has acknowledged the data breach, however, stated they do not currently know how this breach occurred.

Figure 1: Breach listing on RaidForums

Breaking News: 2020-06-12 - 2020-06-18

A Bug in Facebook Messenger for Windows Could've Helped Malware Gain Persistence

Facebook Messenger application for Windows is vulnerable to a flaw that could allow attackers to potentially execute malicious files already present on a compromised system in an attempt to help malware gain persistent/extended access. The vulnerability resides in Messenger version 460.16 that triggers a call to load Windows Powershell from the C:\python27 path which could allow the attackers to hijack such calls that attempt to load potentially non-existent resources to covertly execute malware. Moreover, since the targeted directory is also in a low-integrity location, malicious programs could access the path without administrator privileges. Facebook has fixed the issue in version 480.5, users running a vulnerable version are urged to update to the latest release.

See the full report here: https://thehackernews.com/2020/06/facebook-malware-persistence.html

Protocol Vulnerability Threatens Mobile Networks

Positive Technologies have discovered that the GPRS Tunnelling Protocol (GTP), used to transmit user and control traffic on 2G, 3G, and 4G networks are vulnerable to flaws that could allow attackers to launch denial-of-service (DoS), user impersonation, and fraud cyberattacks. According to researchers, the vulnerabilities are in the protocol's architecture rather than its implementation. To best defend against exploits, the researchers recommend filtering traffic at the GTP level and implementing the GSMA security recommendations.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/protocol-vulnerability-threatens-mobile-networks/d/d-id/1338068

Gamaredon hackers use Outlook macros to spread malware to contacts - BleepingComputer

In a new spearphishing campaign, Gamaredon, a Russia-linked hacker group, is using a package containing a Visual Basic for Applications (VBA) project (.OTM file) that targets Microsoft Outlook email client with malicious macro scripts. According to researchers, the campaign begins with a VBScript that terminates the Outlook process. Next, the script modifies registry values to remove security against executing VBA macros in Outlook and stores on the disk a malicious OTM file that helps spread infected documents to email addresses in the contact list. Outlook supports only one VBA project at a time and the OTM file used in Gamaredon activity contains a VBA script (macro), a malicious email attachment. The threat actor may spear phish all contacts in the victim's address book, everyone in the same organization, or a predefined set of email addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/gamaredon-hackers-use-outlook-macros-to-spread-malware-to-contacts/

Hackers breached A1 Telekom, Austria's largest ISP

A1 Telekom, the largest internet service provider in Austria, disclosed a security breach after suffering a malware infection in November 2019. A1 said its security team detected the malware a month later but battled from December 2019 to May 2020 with attempts to remove all of the malware's hidden backdoor components. The company said that the malware only infected computers on its office network, but not its entire IT system, and no sensitive customer data was compromised. However, according to reports, there are claims that the attackers made specific database queries of location, phone numbers, and other customer data for certain private A1 customers and downloaded massive amounts of customer data. A1 Telekom is yet to respond to the claims.

See the full report here: https://www.zdnet.com/article/hackers-breached-a1-telekom-austrias-largest-isp/

Microsoft discovers cryptomining gang hijacking ML-focused Kubernetes clusters

Microsoft has detected a series of attacks targeting Kubeflow, a toolkit for running machine learning (ML) operations on top of Kubernetes clusters. The attacks aimed to install a cryptocurrency miner on Kubernetes clusters running Kubeflow instances exposed to the internet. According to Microsoft, the attacks have been going on since April this year and since the Kubeflow management panel is exposed only internally and accessible from inside the Kubernetes cluster, by default, Kubeflow admins must have probably changed the Kubeflow default settings and exposed the toolkit's admin panel on the internet.

See the full report here: https://www.zdnet.com/article/microsoft-discovers-cryptomining-gang-hijacking-ml-focused-kubernetes-clusters/

City of Knoxville shuts down network after ransomware attack - BleepingComputer

The City of Knoxville, Tennessee, was hit by a ransomware attack on June 11th, which was noticed by employees of the city's fire department, wherein it had encrypted the computers on Knoxville's network. Following the attack, the city shut down its servers, internet connections, and PCs. It also advised the city employees not to log in to the network or use computer applications at this time. The city reported the ransomware attack to the Federal Bureau of Investigation (FBI) and is currently working with the Tennessee Bureau of Investigation as part of an ongoing incident investigation.

See the full report here: https://www.bleepingcomputer.com/news/security/city-of-knoxville-shuts-down-network-after-ransomware-attack/

Fortune 500 insurance firm Genworth discloses data breach - BleepingComputer

Genworth Financial, a Fortune 500 insurance holding company, disclosed a data breach after an unauthorized party gained access to insurance agents' online accounts using compromised login credentials. The attackers were able to access online documents depending on the accounts that were compromised and that contained some of the following information, in various combinations: name, address, age, gender, date of birth, financial information, social security number, and signature. Due to an ongoing investigation, Genworth disabled the compromised user accounts to block future access to sensitive information. However, the company is currently monitoring the accounts and the policies for suspicious behavior and stated that there was no evidence of further unauthorized activity.

See the full report here: https://www.bleepingcomputer.com/news/security/fortune-500-insurance-firm-genworth-discloses-data-breach/

Power company Enel Group suffers Snake Ransomware attack - BleepingComputer

European energy company giant, Enel Group, suffered a ransomware attack on June 7 that disrupted its internal IT network. However, their antivirus caught the malware before it spread. Enel has not disclosed the name of the ransomware used in the attack, but a security researcher claims to have found a SNAKE/EKANS sample submitted to VirusTotal on June 7 that checks for the domain 'enelint[.]global', which is currently owned by Enel and redirected to the company’s international page when it was live.

See the full report here: https://www.bleepingcomputer.com/news/security/power-company-enel-group-suffers-snake-ransomware-attack/

Twitter bans 32k accounts pushing Chinese, Russian, and Turkish propaganda

Twitter has banned and removed 32,242 accounts that were part of networks operated out of China, Russia, and Turkey, all three pushing local political agendas and narratives, and associated with state-sponsored entities. Of the three networks, the largest was the one based in China wherein it banned 23,750 accounts that were responsible for posting most of the content. It removed 1,152 accounts which ran from Russia and associated with Current Policy, a news site pushing state-backed political propaganda. A third similar network was also banned in Turkey, pushing politically-themed tweets aimed at Turkish-speaking users.

See the full report here: https://www.zdnet.com/article/twitter-bans-32k-accounts-pushing-chinese-russian-and-turkish-propaganda/

Android ‘ActionSpy’ Malware Targets Turkic Minority Group

Security researchers have discovered new Android spyware dubbed ActionSpy that targets victims across Tibet, Turkey, and Taiwan. According to researchers, ActionSpy is being used in ongoing campaigns to target Uyghur (a Turkic minority ethnic group affiliated with Central and East Asia) victims. The spyware is distributed either via watering-hole websites or fake websites wherein the attackers inject the websites with two scripts to load the BeEF framework as well as the ScanBox framework. Once infected, the ActionSpy collects the following information: device location, contact info, call logs, SMS messages. It also has capabilities to make a device connect or disconnect to Wi-Fi, take photos with the camera and screenshots of the device and get chat logs from messaging apps like WhatsApp, China messaging services like QQ, WeChat, and Japanese messaging tool Viber.

See the full report here: https://threatpost.com/android-actionspy-malware-targets-turkic-minority-group/156507/

Live event solutions leader TAIT discloses data breach - BleepingComputer

TAIT, one of the world's leading live event solutions providers, disclosed a data breach that led to the exposure of personal and financial information of its employees. The company discovered the data breach on April 6, 2020, when it noticed that an unauthorized party gained access to one of the company's servers and the email accounts of several TAIT employees. The exposed information includes names, addresses, email addresses, dates of birth, Social Security numbers, and financial account numbers. Following the attack, it immediately took its servers and email systems offline. Although the company is not aware of any misuse of the exposed information, it urges affected individuals to keep an eye out for fraud or identity theft attempts by reviewing their financial account statements and credit reports for any suspicious activity.

See the full report here: https://www.bleepingcomputer.com/news/security/live-event-solutions-leader-tait-discloses-data-breach/

D-Link leaves severe security bugs in home router unpatched - BleepingComputer

Vulnerability researchers have found several security flaws in D-Link DIR-865L router tracked as CVE-2020-13782, CVE-2020-13786, CVE-2020-13785, CVE-2020-13784, CVE-2020-13783, and CVE-2020-13787. These bugs could allow an attacker to execute arbitrary commands, steal sensitive information, upload malware, or delete data. D-Link has released a beta firmware that fixes three out of six vulnerabilities. The product has reached end-of-life for U.S. consumers in early 2016 and recommended replacing them with a newer model that is still supported.

See the full report here: https://www.bleepingcomputer.com/news/security/d-link-leaves-severe-security-bugs-in-home-router-unpatched/

Posh Spice's perfume people pop up in Maze ransomware gang extortion effort

Threadstone Advisors LLP, a New York corporate advisory firm specializing in mergers 'n' acquisitions was struck by Maze ransomware. The Maze group claimed that proof of further stolen data is “coming soon,” according to the announcement. The advisory firm have several big clients including businesswoman Victoria Beckham.

See the full report here: tag:theregister.com,2005:story209186

Italian company exposed as a front for malware operations

For the past four years, an Italian company named CloudEyE has been secretly advertising and providing services to malware gangs. The company operated a seemingly legitimate website and business, offering to provide binary protection against reverse engineering for Windows applications. The company's secret business came to light after security researchers from Check Point found references in the GuLoader code mentioning CloudEyE Protector, an anti-reverse-engineering software service provided by the company. The firm is observed to promote a malware crypting service named DarkEyE, via ads, on various hacking forums. Researchers also linked three usernames and emails used to promote DarkEyE, to the founders of the firm. The Italian authorities are currently investigating the charges against the company and its two founders.

See the full report here: https://www.zdnet.com/article/italian-company-exposed-as-a-front-for-malware-operations/

Privnotes.com Is Phishing Bitcoin from Users of Private Messaging Service Privnote.com

Since last year, a site called Privnotes.com has been impersonating Privnote.com, a legitimate, free service that offers private, encrypted messages which self-destruct automatically after they are read. Privnotes.com is confusingly similar in name and appearance and appears in results as a misleading paid ad for “Privnote”. When a message is created in Privenote (original), a link is generated and is automatically deleted after the message is read. But the phishing site Privnotes.com does not fully implement encryption and can read and/or modify all messages sent by the users. It uses an automated script that scours messages for bitcoin addresses and replaces any bitcoin addresses found with its own bitcoin address. The script apparently modifies messages only if the note is opened from a different Internet address than the one that composed the address. This scam is a reminder why it is necessary to be extra careful about using search engines to find the legitimate sites.

See the full report here: https://krebsonsecurity.com/2020/06/privnotes-com-is-phishing-bitcoin-from-users-of-private-messaging-service-privnote-com/

Small IT firm in Delhi ran one of world’s ‘largest’ hacker-for-hire services: Reuters expose - ThePrint

According to a Reuters report, a small IT firm named BellTrox Infotech Services has been spying on investors, politicians, lawyers, and environmental groups across the world for the past seven years. The firm has spied on over 10,000 email accounts across countries and professions, including judges in South Africa, politicians in Mexico, lawyers in France, environmental groups and journalists in the US and gambling tycoons in the Bahamas. US law enforcement is currently investigating the firm’s involvement in hacking and spying on American users.

See the full report here: https://theprint.in/india/tiny-it-firm-in-west-delhi-ran-one-of-worlds-largest-hacker-for-hire-services-reuters-expose/438889/

Lamphone attack lets threat actors recover conversations from your light bulb

Academics have discovered a new surveillance technique that can record light variations in a light bulb to recover the sound waves (speech, conversations, songs) from a room 25 meters (80 feet) away. This technique is called Lamphone and could allow threat actors to recover conversations from a light bulb. To conduct a Lamphone attack, the attackers need a direct line of sight to the light bulb in a room or public space. Once a line of sight to a light bulb is available, an attacker can use tools like a telescope and an electro-optical sensor to record light variations in the light bulb from large distances and don't necessarily have to be close to their targets. The research team says that all an attacker needs to process Lamphone data is a laptop, which, in turn, can allow them to use Lamphone to follow conversations in real-time.

See the full report here: https://www.zdnet.com/article/lamphone-attack-lets-threat-actors-recover-conversations-from-your-light-bulb/

Black Kingdom ransomware hacks networks with Pulse VPN flaws - BleepingComputer

Enterprises running unpatched Pulse Secure VPN software are being targeted by the operators of Black Kingdom ransomware. The threat actors are exploiting a critical vulnerability, CVE-2019-11510, affecting earlier versions of Pulse Secure VPN that was patched in April 2019. Researchers observed that Black Kingdom operators used the same doorway provided by Pulse Secure VPN to breach their targets. The ransomware established persistence by impersonating a legitimate scheduled task for Google Chrome that runs a Base64-encoded string code in a hidden PowerShell window to fetch a script that opens a reverse shell on the compromised host. Organizations are urged to update to the fixed version of Pulse Secure VPN to defend against Black Kingdom ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/black-kingdom-ransomware-hacks-networks-with-pulse-vpn-flaws/

Hackers use fake contact tracing apps to try installing banking malware on Android phones - CyberScoop

Security researchers have identified nearly twelve applications impersonating the coronavirus contact tracing applications from countries including Italy, Russia, and Singapore. These apps were available outside mainstream marketplaces and are designed to steal personal and financial information from Android users by triggering malicious software. Four of the 12 apps were attributed to either the Anubis banking malware, capable of recording phone calls and keystrokes, or the SpyNote trojan, a hacking tool that accesses text messages, contacts, and GPS location details. The other eight apps directed to more generic malware strains.

See the full report here: https://www.cyberscoop.com/contact-tracing-hacking-security-anomali/

Ransomware Attack Shuts Down Brewing Giant Just As Coronavirus Restrictions Ease - Forbes

Lion, Australia’s largest brewing company, suffered a ransomware attack impacting most of its processes, including production. Following the incident, all systems were immediately taken offline and manual processes to handle orders and deliveries were implemented. The company stated that the investigation is ongoing and there is no evidence currently that personal or financial data has been compromised during the attack.

See the full report here: https://www.forbes.com/sites/leemathews/2020/06/12/ransomware-attack-shuts-down-brewing-giant-just-as-coronavirus-restrictions-ease/

Nintendo Breach: Now 300000 Accounts Affected - Infosecurity Magazine

Japanese consumer electronics and video game giant Nintendo had earlier data admitted to a breach, exposing user login IDs and passwords. New evidence has confirmed that close to 300,000 user accounts were compromised. Nintendo has a unique NNID (Nintendo Network ID) for all its users. NNID acts like a user ID, which can be linked to the Nintendo account and used for login purposes. NNIDs were also used for the 3DS and Wii U and allowed users to download content and link their systems to a shared wallet. Security experts found the source code of the bespoke account checker tool designed specifically to compromise Nintendo users. This indicates the use of credential stuffing techniques to crack weak passwords or conduct phishing attacks to steal users’ data. The company had reset the NNID and Nintendo account passwords for users affected. The users are recommended to enable two-factor authentication and use strong passwords.

See the full report here: https://www.infosecurity-magazine.com:443/news/nintendo-breach-now-300000/

Extortionists threaten to destroy sites in fake ransom attacks - BleepingComputer

In a new extortion campaign, scammers are targeting website owners into paying ransoms between $1,500 and $3,000 in bitcoins by falsely claiming that they have exfiltrated the databases to attacker-controlled servers using credentials harvested after exploiting a vulnerability found within the sites' software. The scammers send blackmail messages asking their potential targets to pay ransoms and threaten them to leak or sell the stolen databases and further scare them into paying out the $2,000 by threatening to de-index the sites from search engines using "blackhat" SEO techniques. Fortunately, almost none of the scammers' targets fell victim to their tricks. Researchers urge targeted website owners to check for proof that their website was hacked, before responding to such extortion emails.

See the full report here: https://www.bleepingcomputer.com/news/security/extortionists-threaten-to-destroy-sites-in-fake-ransom-attacks/

CPA Canada website hit by data breach - Insurance Business Canada

National accounting organization Chartered Professional Accounts Canada (CPA Canada) has disclosed a data breach, potentially impacting the personal information of many members. The company stated that immediate steps were taken to contain the incident and secure the systems. Investigations have revealed that the breach affected more than 329,000 individuals, both members, and other stakeholders. The exposed information potentially included names, addresses, email addresses, and employer names, mainly related to the CPA’s magazine subscription service. CPA Canada offered assurances that in cases where passwords and full credit card numbers were affected, they were all protected by encryption. The company has notified the affected individuals and warned them to remain watchful of targeted phishing scams.

See the full report here: https://www.insurancebusinessmag.com/ca/news/cyber/cpa-canada-website-hit-by-data-breach-224535.aspx

Windows 10 Privacy Settings bug lets users change admin options - BleepingComputer

Windows 10 is vulnerable to a privilege escalation flaw, CVE-2020-1296, in the Windows Diagnostics & Feedback settings app. According to a researcher, the vulnerability exists because of the lack of Privacy Settings Segregation and the incorrect handling of Windows Diagnostic Data feedback in memory across all users on the Windows 10 platform. This bug can allow users to change admin settings. Microsoft has addressed this issue in their June 2020 Patch Tuesday by correcting the way the Windows Diagnostics & feedback Settings app handles objects in memory.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-privacy-settings-bug-lets-users-change-admin-options/

Magecart hackers stole customer data from Intersport and Claire's - TEISS

The websites of Claire's and Intersport have reportedly been attacked by Magecart hackers after they inserted malicious code into the online store of Claire's and Intersport that exfiltrated data from the retailers' checkout page. The malicious code found on Claire's checkout page on 25th April and persisted until 13th June when Claire's removed it from their website. Intersport's malicious checkout page was initially detected and removed on 3rd May, the malicious code was injected into the same website again on 14th May and persisted there until it was removed. Both Claire's and Intersport have not revealed the number of customers affected by the Magecart attacks or the nature of the information that was exfiltrated by the malware into servers managed by the hackers. However, Claire's admitted that the malware exfiltrated payment card information from its e-commerce website but assured customers that cards used in retail stores were not affected by the issue.

See the full report here: https://www.teiss.co.uk/magecart-hackers-struck-claires-intersport/

Dating Apps Exposed 845GB of Explicit Photos, Chats, and More

Security researchers have found a collection of publicly accessible AWS buckets that contained a trove of data from a different specialized dating app, including 3somes, Cougary, Gay Daddy Bear, Xpal, BBW Dating, Casualx, SugarD, Herpes Dating, and GHunt. In total, there were 845 GB and close to 2.5 million records of data from hundreds of thousands of users. The exposed information included sexually explicit photos, audio recordings, screenshots of private chats, payment receipts and other personally identifying information, like real names, birthdays, email addresses. Researchers warn that these data can be leveraged for doxing, extortion, and other dire online abuse.

See the full report here: https://www.wired.com/story/dating-apps-leak-explicit-photos-screenshots/

US bank customers targeted in ongoing Qbot campaign - BleepingComputer

Security researchers have identified an ongoing Qbot malware campaign targeting nearly 36 different U.S. financial institutions to steal credentials from US bank customers. The malware is delivered using browser hijacks and once dropped on a victim's machine, Qbot is loaded within the explorer.exe process' memory, copies itself in the %APPDATA% folder, and gains persistence by adding a new registry key to launch itself on system reboot. The %APPDATA% copy is executed and the malware injects itself into a new explorer.exe process. The Qbot operators later use this malicious process to update the bot instance from their command-and-control server. As Qbot watches a victim’s web traffic, it looks for specific financial services to harvest credentials. Among the banks whose customers have been targeted in this Qbot campaign, the researchers found JP Morgan, Citibank, Bank of America, Citizens, Capital One, Wells Fargo, and FirstMerit Bank.

See the full report here: https://www.bleepingcomputer.com/news/security/us-bank-customers-targeted-in-ongoing-qbot-campaign/

Intel adds CPU-level malware protection to Tiger Lake processors

Intel has announced a new feature called Control-Flow Enforcement Technology (Intel CET), capable of providing CPU-level security, offering protection against malware using control-flow hijacking attack methods on devices with Intel's future Tiger Lake mobile processors. Intel CET provides two new key capabilities to help guard against control-flow hijacking malware, Shadow Stack (SS), and Indirect Branch Tracking (IBT). IBT defends against attacks using jump/call oriented programming (JOP and COP), while SS protects against return-oriented programming (ROP) attacks. Intel has worked closely with Microsoft to include support for Intel CET in the Windows 10 OS and in developer tools to provide more reliable protection against control-flow hijacking threats by expanding on the already available software-only control-flow integrity solutions.

See the full report here: https://www.bleepingcomputer.com/news/security/intel-adds-cpu-level-malware-protection-to-tiger-lake-processors/

DraftKings discloses SBTech ransomware attack in SEC filing - BleepingComputer

In a Form S-1 filed with the SEC, DraftKings (online fantasy sports leader) disclosed that SBTech( online gambling technology provider), who they merged within April 2020, was hit by a ransomware attack. On March 27, 2020, SBTech detected a ransomware attack on its network that interrupted its sports betting and iGaming services of customers. Following the attack, SBTech immediately shut down its data centers and informed relevant regulatory authorities and notified affected partners and customers.

See the full report here: https://www.bleepingcomputer.com/news/security/draftkings-discloses-sbtech-ransomware-attack-in-sec-filing/

Plex fixes Media Server bugs allowing full system takeover - BleepingComputer

Plex Media Server, a desktop app and the backend server for the Plex media streaming service, for Windows is vulnerable to flaws that could allow attackers to take full control of the underlying system when chained together. The flaws are tracked as CVE-2020-5740, CVE-2020-5741, and CVE-2020-5742 and if paired together, can enable attackers to remotely execute code as SYSTEM, fully taking over the operating system, gain access to all files, deploy backdoors, or move laterally to other devices on the same network. Plex has rolled out patches for CVE-2020-5740, CVE-2020-5741, and mitigated CVE-2020-5742 via server-side changes. Users are urged to update to the fixed versions of the Plex Media Server to avoid risks.

See the full report here: https://www.bleepingcomputer.com/news/security/plex-fixes-media-server-bugs-allowing-full-system-takeover/

Adobe Releases PDF Protected Mode for Document Cloud

Adobe has released PDF Protected Mode as part of Adobe's Document Cloud. The secure PDF includes a preview of Adobe Acrobat DC Protected Mode and opens PDF files in a sandbox to protect users who open malicious Acrobat documents. This feature is available to Windows users running Adobe Acrobat DC version 20.009.20063.281938 or higher.

See the full report here: https://www.darkreading.com/cloud/adobe-releases-pdf-protected-mode-for-document-cloud/d/d-id/1338103

Chipmaker MaxLinear reports data breach after Maze Ransomware attack - BleepingComputer

U.S. system-on-chip (SOC) maker company MaxLinear disclosed a data breach after Maze Ransomware encrypted some of its computing systems and leaked 10.3GB of accounting and financial information out of the over 1TB of data allegedly stolen before encrypting MaxLinear's systems. The leaked information possibly includes personally identifiable (PII) and financial information such as name, personal and company email address and personal mailing address, employee ID number, driver’s license number, financial account number, Social Security number, date of birth, work location, compensation and benefits information, dependent, and date of employment. The SOC maker has notified the impacted individuals and has restored some of the systems affected during the attack and its IT staff is still working on bringing back up the rest.

See the full report here: https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/

Ripple20 vulnerabilities will haunt the IoT landscape for years to come

Cyber-security experts have revealed multiple vulnerabilities in a small library developed by Cincinnati-based software company Treck. Collectively referred to as Ripple20, the vulnerabilities impact hundreds of products including smart home devices, power grid equipment, healthcare systems, industrial gear, transportation systems, printers, routers, mobile/satellite communications equipment, data center devices, commercial aircraft devices, various enterprise solutions, and many others. The library was first released in 1997 to implement a lightweight TCP/IP stack, allowing devices/software to connect to the internet via TCP/IP connections. The Department of Homeland Security has attributed ratings of 10 and 9.8 to four of the vulnerabilities of the Ripple20 vulnerabilities.

See the full report here: https://www.zdnet.com/article/ripple20-vulnerabilities-will-haunt-the-iot-landscape-for-years-to-come/

Adobe fixes critical flaws in Illustrator, After Effects, more - BleepingComputer

Adobe has released an out-of-bound security advisory to address 18 critical flaws in Adobe After Effects, Illustrator, Premiere Pro, Premiere Rush, and Audition on Windows and macOS devices. The vulnerabilities could allow attackers to execute arbitrary code on systems running vulnerable applications. Users are advised to update the vulnerable apps to the newest versions using the Creative Cloud update mechanism to mitigate vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-flaws-in-illustrator-after-effects-more/

South African bank to replace 12m cards after employees stole master key

A fraudulent transaction has led to a loss of about more than USD 3.2 million for Postbank, the banking division of South Africa’s post office. The customer cards were generated with the use of the stolen and printed banks' master key. The master key is a 36-digit code (encryption key) that allows its holder to decrypt the bank's operations, access and modify banking systems, and can generate keys for customer cards. According to the internal report, between March and December 2019, the rogue employees used the master key to access accounts and made more than 25,000 fraudulent transactions. Following the breach discovery, Postbank will now have to replace more than 12 million cards for its customers that have been generated with the master key.

See the full report here: https://www.zdnet.com/article/south-african-bank-to-replace-12m-cards-after-employees-stole-master-key/

Cisco fixes severe flaws in Webex Meetings for Windows, macOS

Cisco released security updates to address two high severity vulnerabilities found in the Cisco Webex Meetings Desktop App for Windows and macOS that could allow unprivileged attackers to run programs and code on vulnerable machines. The vulnerabilities affect Cisco Webex Meetings Desktop App releases earlier than 39.5.12 and lockdown versions of Cisco Webex Meetings Desktop App for Mac earlier than 39.5.11, respectively. A successful exploit could allow a remote attacker to bypass security controls and execute other programs, tracked as CVE-2020-3263. CVE-2020-3342 could allow unauthenticated attackers to remotely execute arbitrary code with the privileges of the user logged on Mac. Cisco Webex users are recommended to upgrade to the latest versions.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-severe-flaws-in-webex-meetings-for-windows-macos/

Well-Known Ransomware Gang Strikes Three Companies in the US and Canada - Cointelegraph

Ransomware group REvil has targeted three companies in the U.S. and Canada. The companies are Goodman Mintz LLP, Strategic Sites LLC, and ZEGG Hotels & Store. The gang leaked sensitive data from Goodman Mintz LLP, which includes company files, accounting and working documents of clients, databases, data for logging into client banks, and audit results of companies. Documents belonging to the duty-free store, ZEGG, were also reportedly leaked. Further, REvil threatened to leak data from Strategic Sites LLC if they fail to reach an agreement with the gang and may auction the data.

See the full report here: https://cointelegraph.com/news/well-known-ransomware-gang-strikes-three-companies-in-the-us-and-canada

T-Mobile outage caused by configuration error, not a DDoS attack - BleepingComputer

The rumors began circulating on Twitter that the U.S. was under a massive DDoS attack. However, T-Mobile has provided an update stating the outage occurred due to a leased fiber circuit failure from a third-party provider, based in the Southeast. On June 15th, the outage leftover 110,000 T-Mobile users unable to make or receive calls. On June 16th, T-Mobile's President of Technology has confirmed that the issue has resolved, and voice and text services have restored.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-outage-caused-by-configuration-error-not-a-ddos-attack/

An ongoing Qbot campaign targeted customers of tens of US banks

Security researchers at F5 Labs have uncovered an ongoing campaign that delivers Qbot malware payloads to steal credentials from customers of US financial institutions. The Qbot variant has a new feature that adds both detection and research-evasion techniques. It has a new packing layer that scrambles and hides the code from scanners and signature-based tools. It also includes anti-virtual machine techniques, which helps it resist forensic examination. The malware gets distributed through phishing attacks that trick the victims into visiting websites that use exploits to inject Qbot via a dropper. Qbot monitors the victim’s web traffic for specific strings associated with financial services to capture credentials. It also makes lateral movements via network share exploits to infect other systems on the same network and leverage brute-force attacks to target Active Directory admin accounts.

See the full report here: https://securityaffairs.co/wordpress/104916/hacking/qbot-campaign-us-banks.html?utm_source=rss&utm_medium=rss&utm_campaign=qbot-campaign-us-banks