Threat Intelligence Bulletin: 06/19/2020 - 06/25/2020

Breach Disclosure: Quidd

Quidd, an online marketplace for trading stickers, cards and other collectibles, suffered a data breach in 2019. The breach contained approximately 4 million rows of user data, which are now being circulated for free in underground hacking and cybercrime forums. The data includes email addresses, usernames and bcrypt password hashes.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Those amongst the underground hacker forum community attribute the breach to a hacker known as ProTag. Multiple posts have been made on these forums that shout out ProTag. The data was traded privately for a number of months, but has now been made free to download amongst these users. This could be due to the password hashes being hashed using bcrypt, which makes it much harder to brute force passwords at scale.

Image from ZDNet where a user posted the data for free

Breaking News: 2020-06-19 - 2020-06-25

IcedID Banker is Back, Adding Steganography, COVID-19 Theme

Security researchers at Juniper Threat Labs have uncovered an email spam campaign circulating in the United States, spreading the new version of the IcedID banking trojan. The messages use the COVID-19 pandemic and the Family and Medical Leave Act (FMLA) as their theme and come with the boobytrapped attachments embedded with malicious macros that, if opened, execute the IcedID banking trojan. This latest variant changes up its infection tactics by injecting into msiexec.exe to insert itself into browser traffic and using full steganography for downloading its modules and configurations. It monitors browser activity related to financial transactions and injects forms on the fly to try to steal credit card details.

See the full report here: https://threatpost.com/icedid-banker-adding-steganography-covid-19-theme/156718/

Google Yanks 106 ‘Malicious’ Chrome Extensions

Google removed 106 Chrome browser extensions from its Chrome Web Store that used to siphon sensitive user data. The attackers used these Google Chrome browser extensions to steal data as well to create persistent footholds on the networks of financial services, oil and gas, media and entertainment, healthcare and pharmaceuticals, and government organizations. According to the researchers, the campaign was aided by the internet domain registrar CommuniGal Communication Ltd. (GalComm). In the past three months, researchers have harvested 111 malicious or fake Chrome extensions using GalComm domains for attacker command and control infrastructure and/or as loader pages for the extensions. These extensions can take screenshots, read the clipboard, harvest credential tokens stored in cookies or parameters, grab user keystrokes.

See the full report here: https://threatpost.com/google-yanks-106-malicious-chrome-extensions/156731/

Wells Fargo phishing baits customers with calendar invites - BleepingComputer

Wells Fargo customers are being targeted by a phishing campaign impersonating the Wells Fargo Security Team and luring potential victims to phishing pages with the help of calendar invites. The phishing emails claim the user to update the security keys and urges to open the malicious attachment and follow the instructions to avoid having their accounts suspended. The attachment is a .ics (calendar invite) file, utilized by calendar applications to store scheduling information. The Contained within the event description is a link to a Sharepoint page that directs the users to fake phishing page for Wells Fargo, where users are prompted to enter sensitive information such as username, password, PIN, and account numbers. The criminals can use the information to take over the victims’ accounts and transfer funds out of their accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/wells-fargo-phishing-baits-customers-with-calendar-invites/

InvisiMole group targets military sector and diplomatic missions in Eastern Europe

InvisiMole is back targeting a small number of high-profile organizations in the military sector and diplomatic missions in Eastern Europe and with an advanced persistent threat (APT) group partnership. The group resurfaced with an updated toolset dropping InvisiMole tools and malicious code on a small number of targets using a .NET downloader associated with the Gamaredon, (APT) group. The new backdoor scans the compromised network for hosts that support the vulnerable SMBv1.0 protocol. The updated InvisiMole toolset features a new component that uses DNS tunneling for stealthier command-and-control (C2) communication and uses NSA exploit EternalBlue (CVE-2019-0708) and BlueKeep (CVE-2017-0144) for lateral movement in its victims’ networks. The activity of the group is characterized by the heavy use of legitimate tools and per-victim encryption in the early stages of the attack chains.

See the full report here: https://securityaffairs.co/wordpress/104942/apt/invisimole-campaign.html?utm_source=rss&utm_medium=rss&utm_campaign=invisimole-campaign

North Korean state hackers reportedly planning COVID-19 phishing campaign targeting 5M across six nations

North Korean state hacker group Lazarus is said to be behind a large-scale campaign targeting more than 5 million individuals and businesses, including small and large enterprises, across six countries: Singapore, South Korea, Japan, India, the UK, and the US, that is scheduled to take place June 21. The hacker group is looking to gain financially from the campaign, where targeted email recipients will be asked to visit fraudulent websites and lured into revealing their personal and financial data, according to Cyfirma. Singapore's Ministry of Manpower (MOM) issued an alert on the fake MOM website was phishing for personal information. Other government agencies targeted in the email spoof included Japan's Ministry of Finance and England's central bank. Amongst others, Lazarus' hackers claimed to have details of 1.1 million individual email IDs in Japan, another 2 million in India, and 180,000 business contacts in the UK.

See the full report here: https://www.zdnet.com/article/north-korean-state-hackers-reportedly-planning-covid-19-phishing-campaign-targeting-5m-across-six-nations/

O365 Phishing Campaign Leveraged Legit Domains

Security researchers at Checkpoint have discovered a new phishing campaign aimed at Office 365 users. The campaign uses a legitimate Adobe marketing redirect mechanism, website script injection, and legitimate domains owned by Samsung, Adobe, and Oxford University to convince victims to give up their Office 365 credentials. The attackers used Oxford University's email servers to launch the phishing messages containing an unheard voicemail message. Upon clicking the link, victims are landed on a legit website and then redirected to a series of compromised WordPress websites with a separate subdirectory for each victim leading to unique URLs. Users are advised to be vigilant on suspicious links and attachments.

See the full report here: https://www.darkreading.com/attacks-breaches/o365-phishing-campaign-leveraged-legit-domains/d/d-id/1338124

[HACK ALERT] Google Alerts Identified Fake Adobe Flash Update Notifications, Deploying Malware: Fake Warnings - Tech Times

Hackers are using fake breach notifications to spread malware. Google Alerts discovered compromised websites created by scammers which uses fake notifications that trick users to install the latest version of the fake flash player and extensions.

See the full report here: https://www.techtimes.com/articles/250392/20200617/hackers-google-alerts-identified-fake-breach-notifications-deploying-malware-fake-warnings-use-spam-pages-directing-to-malicious-sites.htm

Netgear Zero-Day Allows Full Takeover of Dozens of Router Models

Researchers have discovered an unpatched, zero-day vulnerability in Netgear routers. The security flaw exists in the firmware's httpd web server, which allows attackers to bypass authentication on affected installations of Netgear routers. The only current mitigation for the vulnerability is to restrict interaction with the service to trusted machines.

See the full report here: https://threatpost.com/netgear-zero-day-takeover-routers/156744/

‘Severe’ Cisco WebEx flaw grants hackers access to meeting data

Cisco has patched a dangerous flaw that allows a hacker to access victims’ accounts from another machine to see all meetings, individuals invited, meeting passwords, and past meeting records. The shared memory information leakage vulnerability tracked as CVE-2020-3347, found in the Cisco WebEx Meetings desktop app for Windows, allows an authenticated attacker to gain access to sensitive information either locally, or by running a malicious program. Cisco has released a software update addressing this vulnerability, urging users to update their Cisco Webex Meetings software to version 40.6.0 and higher.

See the full report here: https://www.itpro.co.uk/security/vulnerability/356141/severe-cisco-webex-flaw-grants-hackers-access-to-meeting-data

Hackers are using this strange technique to launch attacks against Windows devices - TechRadar

Security researchers at Huntress Labs have discovered a new attack technique that uses several tricks, including renaming legitimate files, impersonating an existing scheduled task, and using fake error logs to hide in plain sight. Upon gaining persistence on a targeted system, the attacker uses a fake error log file that stores ASCII characters disguised as hexadecimal values that prepare the system for script-based attacks. The technique also uses two executables. The first is “BfeOnService.exe”, is a copy of a utility called “mshta.exe” abused to execute a VBScript to start PowerShell and run a command in it. The other executable is 'engine.exe', is a copy of 'powershell.exe' used to extract the ASCII numbers contained in the fake error log and convert them to get the payload, which further collects information about browsers, tax software, security software, and PoS software installed on the system.

See the full report here: https://www.techradar.com/news/hackers-are-using-this-strange-technique-to-launch-attacks-against-windows-devices

Hacker arrested for stealing, selling PII of 65K hospital employees - BleepingComputer

A hacker was arrested earlier this week for allegedly hacking the health care provider and insurer University of Pittsburgh Medical Center (UPMC) in 2014, stealing the PII and W-2 information of over 65,000 employees, and selling it on the dark web. UPMC is Pennsylvania’s largest healthcare provider with over 90,000 employees, integrating 40 hospitals and 700 doctors’ offices and outpatient sites. The HR database network of the company was infiltrated around December 1, 2013, via Oracle PeopleSoft human resource management system. The hacker sold the stolen database on multiple dark web markets.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-arrested-for-stealing-selling-pii-of-65k-hospital-employees/

Discord modified to steal accounts by new NitroHack malware - BleepingComputer

Security researchers have spotted a new malware called NitroHack that modifies the Windows discord client to turn it into an account-stealing Trojan. NitroHack purports to be a hack that can provide the premium Discord Nitro service for free but instead steals user tokens saved in various browsers, credit card information and then tries to spread it to others. If a user downloads the promoted file and launches it, NitroHack modifies the %AppData%\Discord\0.0.306\modules\discord_voice\index.js file and append malicious code to the bottom and becomes persistent plus sends the victim's user tokens to the attacker's Discord channel every time they start the Discord client. Using these stolen user tokens, the threat actor can then log into Discord as the victim and steal saved payment information. Infected users are urged to uninstall the Discord client and re-install it.

See the full report here: https://www.bleepingcomputer.com/news/security/discord-modified-to-steal-accounts-by-new-nitrohack-malware/

Netgear router security flaws finally patched after six months - TechRadar

Netgear routers are vulnerable to security flaws that could allow the attackers to take full control of the devices remotely. These vulnerabilities affect nearly 79 Netgear device models. Affected router models have an HTTPD daemon that does not adequately check the length of data supplied by a user, allowing an attacker to create a buffer overflow when data is copied to a fixed-length variable. Netgear has issued patches to fix security vulnerabilities in two of its router models, R6400v2 and R6700v3. However, 77 of Netgear's other routers reportedly yet remain vulnerable to a zero-day vulnerability that was reported to the company back in January of this year. Owners of router models R6400v2 and R6700v3 are advised to patch their devices to mitigate risks.

See the full report here: https://www.techradar.com/news/netgear-router-security-flaws-finally-patched-after-six-months

Attackers hit Thai power authority using Maze ransomware - iTWire

Hackers have targeted Thailand's Provincial Electricity Authority using the Maze ransomware, which runs only on Windows, and have released data from the company on their dark web site. The Electricity Generating Authority of Thailand has three thermal power plants, six combined cycle power plants, 24 hydropower plants, eight renewable energy plants, and four diesel power plants that supply electricity to Thailand. Hackers have posted three zipped files containing 8.5 GB of data. The company is yet to respond to the incident.

See the full report here: https://www.itwire.com/security/attackers-hit-thai-power-authority-using-maze-ransomware.html

AMD says it will fix new CPU bugs by the end of June 2020

AMD has announced to release firmware updates to fix a trifecta of bugs that impact some of its notebook and embedded systems CPUs, by the end of June 2020. The three bugs, which AMD refers to as "SMM Callout," allow attackers to take control over the UEFI firmware of AMD CPUS, and inherently of the entire computer. The bugs impact a small fraction of Accelerated Processing Unit (APU) CPUs that are released between 2016 and 2019. AMD had already released patches for the first bug, tracked as CVE-2020-14032. Two other bugs remain unpatched, but the company plans to have AGESA patches ready by the end of the month.

See the full report here: https://www.zdnet.com/article/amd-says-it-will-fix-new-cpu-bug-by-the-end-of-june-2020/

Adobe wants users to uninstall Flash Player by the end of the year

Adobe is planning to prompt users to uninstall Flash Player from their computers by the end of the year as the software is scheduled to reach End-Of-Life (EOL), on December 31, 2020. Flash Player has always been targeted by hackers and malware authors. Once the software has reached the EOL date, the company plans to stop providing updates and remove all Flash Player download links from their website. Adobe has made these aggressive decisions to restrict users from using its software once it reaches EOL.

See the full report here: https://www.zdnet.com/article/adobe-wants-users-to-uninstall-flash-player-by-the-end-of-the-year/

New Shlayer Mac malware spreads via poisoned search engine results

Researchers have discovered a new variant of the Shlayer Mac malware that tricks victims into bypassing Apple’s built-in macOS security protections. The malware is spread via fake Adobe Flash Player installer (.DMG disk image) and uses sneaky tactics to evade antivirus detection. Upon opening the Flash Player installer, the disk image will mount and display instructions that tell users to first right-click on the Flash Installer and click Open to launch the fake installer that is actually a bash shell script, which opens and runs itself in the Terminal app, it then extracts a self-embedded, password-protected .zip archive file, which contains a traditional Mac .app bundle. The script installs the Mac app into a hidden temporary folder, then it launches the app and quits the Terminal. The malware can be used to download other malicious payloads, including malware or adware. In the campaign spotted by the researchers, the malware spread via poisoned search engine results, including Google, Bing, Yahoo!, DuckDuckGo, Startpage, and Ecosia.

See the full report here: https://securityaffairs.co/wordpress/105028/malware/shlayer-mac-malware-search-engines.html?utm_source=rss&utm_medium=rss&utm_campaign=shlayer-mac-malware-search-engines

Apparel retailer Bossini reveals customer data hack - Retail News Asia

Bossini, a Hong Kong-based apparel retailer suffered a data breach earlier this month, impacting its database of loyalty program members and online customers. The exposed information included customers’ names, addresses, phone numbers, email addresses, gender, age-range, and month of birth. The company said that the leaked files did not contain any information on the identification card numbers and credit card numbers or payment information of the customers. Bossini took immediate action to contain the event and has commenced a detailed investigation.

See the full report here: https://www.retailnews.asia/apparel-retailer-bossini-reveals-customer-data-hack/

‘BlueLeaks’ Exposes Files from Hundreds of Police Departments

A large number of sensitive files, dubbed BlueLeaks, from police departments across the United States were leaked online last week. The leak stems from a security breach at a Texas web design and hosting company that maintains several state law enforcement data-sharing portals. National Fusion Center Association (NFCA) has confirmed the validity of the leaked data and noted that the dates of the files in the leak measure nearly 24 years, from August 1996 to June 19, 2020. The leaked documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV, ZIP files, and more.

See the full report here: https://krebsonsecurity.com/?p=52037

Office 365 now checks docs for known threats before editing - BleepingComputer

Microsoft has announced the general availability of the Office 365 Safe Documents security feature which expands the protection provided by Protected View that checks for untrusted documents for risks and known threats. On endpoints where the Safe Documents feature is enabled, all untrusted files opened in Protected View will be uploaded and scanned by Microsoft Defender ATP. During active scans of untrusted documents originating from outside the enterprise users' organizations, the customers will be blocked from leaving Protected View and from editing the content. If the files are found as being free of malicious content, users will be able to exit the Protected View. If the document is deemed unsafe, the users will be warned and blocked from exiting Protected View.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-now-checks-docs-for-known-threats-before-editing/

Microsoft says June 2020 updates break Outlook for some users - BleepingComputer

According to Microsoft, users running Outlook version 2005 Build 12827.20268 or higher will see an error prompting the users to repair some inbox files. Microsoft says the issue is caused by the June 2020 updates and that an official fix is not yet available for customers using stable Outlook versions after updating to version 2005 Build 12827.20268 or later. However, an initial fix is being tested by users of Outlook Insider Beta version 13004.10000. As of now, Microsoft has provided a workaround that should make Outlook usable again for all users and it requires modifying the registry by deleting some keys related to the PST document format. Microsoft also warns of serious problems that might occur if users modify the registry incorrectly.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-says-june-2020-updates-break-outlook-for-some-users/

BitDefender fixes bug allowing attackers to run commands remotely - BleepingComputer

BitDefender is vulnerable to a flaw that could allow an external, specially crafted web page to run remote commands inside its Safepay Utility process. The flaw is tracked as CVE-2020-8102 and exists because of an Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020. It affects all the versions of Bitdefender Total Security before 24.0.20.116. the company has patched the issue and rolled out an automatic update that fixes this vulnerability in versions 24.0.20.116 and later.

See the full report here: https://www.bleepingcomputer.com/news/security/bitdefender-fixes-bug-allowing-attackers-to-run-commands-remotely/

Indiabulls Group hit by CLOP Ransomware, gets 24h leak deadline - BleepingComputer

The CLOP Ransomware operators claimed to have breached Indiabulls Group and have posted screenshots of files that they have allegedly stolen during the attack. Indiabulls Group is an Indian conglomerate with $3.5 billion in revenue (2019), over 19,000 employees, and subsidiaries focusing on housing, personal finance and lending, infrastructure, and pharmaceuticals. The hackers posted the stolen files on their data leak site with a threat that more data will be leaked if the ransom demand is not paid. The leaked documents include a voucher, a letter, and four spreadsheets related to the Indiabulls Pharmaceuticals and Indiabulls Housing Finance Limited subsidiaries. The company is yet to confirm the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/indiabulls-group-hit-by-clop-ransomware-gets-24h-leak-deadline/

Hackers use Google Analytics to steal credit cards, bypass CSP - BleepingComputer

Hackers are using Google's servers and the Google Analytics (GA) platform to steal credit card information submitted by customers of online stores. A new method is being widely used to bypass Content Security Policy (CSP) using the Google Analytics API, to scrape credit card data from several dozen e-commerce sites. Attackers designed a web skimmer script to encode stolen data and deliver it to the attacker's GA dashboard in an encrypted form. The attackers use their own Tag ID to abuse GA for sending harvested info such as credentials, credit card data, and more. Magecart campaign, which began on March 17, abused this exact issue to bypass CSP on several dozen e-commerce sites using Google Analytics.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-google-analytics-to-steal-credit-cards-bypass-csp/

New privacy and security features announced at Apple's WWDC 2020

Apple has announced new privacy and security features for iOS and macOS users at the 20th edition of its Worldwide Developers Conference (WWDC). These features will make it much harder for online advertisers to track users. One of the most important changes this year is a new app privacy disclosure prompt. This new feature will let users know the type of data each app collects and will allow apps to be transparent about the data type they use to track users across the web. Additionally, apps that engage in cross-app tracking will have to request special permission from users going forward. Apple has also announced the ability to dumb-down location sharing. Starting later this year, users will be able to share "proxy location" instead of precise coordinates. Apart from anti-user-tracking features, the company has also added a new feature to counter apps that secretly access an iOS device's camera and microphone.

See the full report here: https://www.zdnet.com/article/new-privacy-and-security-features-announced-at-apples-wwdc-2020/

80,000 printers are exposing their IPP port online

Researchers at Shadowserver Foundation have identified the printing devices using IPP (an HTTP POST based protocol) that have been connected to the Internet without adequate access controls or authorization mechanisms in place. Such devices are vulnerable to different types of attacks, including information disclosure, service disruption/tampering, and remote command execution. The tool Internet Printing Protocol (IPP) scan discovers devices that have an open IPP (Internet Printing Protocol) service enabled on port 631/TCP. Out of 80,000 exposed services, a large percentage returned additional printer information attributes, such as printer names, locations, models, firmware versions, organizational units, and WiFi SSIDs’. Users are recommended to protect the vulnerable printers using a firewall and enable authentication.

See the full report here: https://www.zdnet.com/article/80000-printers-are-exposing-their-ipp-port-online/

Ransomware group auctions Crozer-Keystone Health System data on darknet - Becker's Hospital Review

Crozer-Keystone Health System recently suffered a ransomware attack by the NetWalker ransomware gang. It is one of the leading healthcare provider and employer, located in Delaware County. The group is now auctioning the system’s stolen data through its darknet website. If it is not purchased at auction within six days, the gang has vowed to leak the data. The gang claims that Crozer-Keystone Health System failed to pay for the ransom they demanded in Bitcoin (BTC). The Crozer-Keystone information technology team has isolated the intrusion and took systems offline.

See the full report here: https://www.beckershospitalreview.com/cybersecurity/ransomware-group-auctions-crozer-keystone-health-system-data-on-darknet.html

Ryuk ransomware deployed two weeks after Trickbot infection - BleepingComputer

Researchers at SentinelOne have detailed the activity observed from logs on a Cobalt Strike server that TrickBot used to profile networks and systems. These indicate that the threat actor takes an average of two weeks pivoting to valuable hosts on the network before deploying Ryuk ransomware. Once the network is compromised, hackers scan live systems for open ports providing specific services like FTP, SSH, SMB, SQL server, remote desktop, and VNC. They also use Mimikatz to extract passwords that would help with lateral movement. Based on the timestamps, researchers estimated that the infection took two weeks for the attacker to gain access to machines on the network and profile them before executing Ryuk.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-ransomware-deployed-two-weeks-after-trickbot-infection/

European victims refuse to bow to Thanos ransomware - BleepingComputer

The victims of the Thanos ransomware campaign are refusing to pay the ransoms to have their data decrypted. Thanos ransomware is a Ransomware-as-a-Service (RaaS) operation advertised on Russian-speaking hacker forums that allow affiliates to customize their own ransomware through a builder offered by the developer. They targeted mid-level employees of multiple organizations from Austria, Switzerland, and Germany. The ransomware was widely distributed via phishing campaigns with camouflaged droppers to drop the malware. Researchers have found no transactions showing payment of the ransom to the bitcoin wallet.

See the full report here: https://www.bleepingcomputer.com/news/security/european-victims-refuse-to-bow-to-thanos-ransomware/

US govt to enforce HTTPS on new .gov sites starting September 1 - BleepingComputer

The U.S Government’s DotGov Program has announced that starting September 1, 2020, new .gov sites will only be accessible via HTTPS. The DotGov Program is overseen by the U.S. General Services Administration (GSA) and it operates the .GOV top-level domain (TLD) and provides .gov domains to US-based government organizations, from federal agencies to local municipalities. The government intends to provide secure connections for users visiting government sites using Transport Layer Security protocol (TLS) by encrypting the exchanged data, alternating them if the exchanged data was altered, and protecting them from man-in-the-middle attacks. By automatically preloading only the new .gov domains, the program ensures transitioning of historical domains, not new ones, and defaults to strong security going forward.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-to-enforce-https-on-new-gov-sites-starting-september-1/

New WastedLocker Ransomware distributed via fake program updates - BleepingComputer

Evil Corp has started distributing a new ransomware variant called WastedLocker in targeted attacks against businesses. The ransomware is distributed by hacking into sites to insert malicious code that displays fake software update alerts from the SocGholish fake update framework, including the Cobalt Strike penetration testing and post-exploitation toolkit, which Evil Corp uses to gain access to the infected device. The threat actors then use this access to compromise the network further and deploy the WastedLocker Ransomware. According to researchers, when launched, the WastedLocker ransomware will pick a random EXE or DLL file under C:\Windows\System32 and use that file's name to create a new file without an extension under the %AppData% folder. Attached to this file is an alternative data stream named 'bin', which will then be executed. Once executed, the ransomware will attempt to encrypt all drives on the computer, skipping files in specific folders or containing certain extensions. For every encrypted file, WastedLocker creates a ransom note demanding a ransom ranging from $500,000 to millions of dollars.

See the full report here: https://www.bleepingcomputer.com/news/security/new-wastedlocker-ransomware-distributed-via-fake-program-updates/

Microsoft Defender ATP can now protect Linux, Android devices - BleepingComputer

Microsoft has announced that its Defender Advanced Threat Protection (ATP) has expanded to non-Windows platforms and is now generally available for enterprise customers using Linux devices and in public preview for those with Android devices. On Linux endpoints, the Microsoft enterprise endpoint security solution comes in the form of a command-line product that sends all threats it detects to the Microsoft Defender Security Center. Currently, Microsoft Defender ATP for Linux comes with support for recent versions of the most common Linux Server distributions, including RHEL 7.2+, CentOS Linux 7.2+, Ubuntu 16 LTS or higher LTS, SLES 12+, Debian 9+, Oracle Linux 7.2. The public preview of Microsoft Defender ATP for Android will offer protection against phishing and unsafe network connections from apps, websites, and malicious apps and all events and alerts will be available through a single pane of glass in the Microsoft Defender Security Center. Customers with preview features enabled can try out Microsoft Defender ATP for Android starting today.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-defender-atp-can-now-protect-linux-android-devices/

REvil ransomware scans victim's network for Point of Sale systems - BleepingComputer

In a new campaign against services, food, and healthcare industry sectors, REvil ransomware operators have scanned one of their victim's network for Point of Sale (PoS) servers along with using the off-the-shelf Cobalt Strike penetration testing toolkit to deploy REvil (aka Sodinokibi) ransomware payloads. Researchers have found Cobalt Strike on the networks of eight firms, with the attackers infecting and encrypting three companies from the services, food, and healthcare industry sectors with the REvil ransomware. The REvil operators also scanned the healthcare organization's network for PoS systems as part of an opportunistic activity in this campaign, or a new tactic adopted by ransomware gang.

See the full report here: https://www.bleepingcomputer.com/news/security/revil-ransomware-scans-victims-network-for-point-of-sale-systems/

Twitter alerts business customers after flagging data breach

Twitter has notified its business clients, informing them that their personal information on its advertising or analytics platforms may have been compromised in a data security incident. Prior to 20 May, the company revealed, if business customers accessed their billing information, the data on this page would have been improperly stored in the cache of their internet browser. The potentially exposed information included email addresses, phone numbers, the last four digits of users’ payment cards, and billing addresses. The company said that exposed information did not include complete card numbers, expiration dates, or security codes. If users currently use a shared computer to access their Twitter Ads or Analytics billing information, Twitter urges them to clear the browser cache when they log out. The company has apologized for the incident.

See the full report here: https://www.itpro.co.uk/security/data-breaches/356190/twitter-alerts-business-customers-after-flagging-data-breach

Twitter bans DDoSecrets account over 'BlueLeaks' police data dump

Twitter has permanently suspended the @DDoSecrets Twitter account for violating its policy about the distribution of hacked data after the account shared links to hacked data stolen from US law enforcement agencies. The BlueLeaks files were made available on the DDoSecrets web portal, but they were also announced and heavily promoted via Twitter. The DDoSecrets account belonged to an activist group going by the formal name of Distributed Denial of Secrets. The group published a data dump worth 296 GB, dubbed BlueLeaks, which they claimed to have received from the Anonymous hacker collective. BlueLeaks is considered to be the biggest hack in the history of US law enforcement, revealing more than ten years worth of sensitive files about how US police trained personnel and conducted operations.

See the full report here: https://www.zdnet.com/article/twitter-bans-ddosecrets-account-over-blueleaks-police-data-dump/

Hackers Threaten to Auction Legal Documents Involving Mariah Carey, Nicki Minaj, MTV, More - Variety

REvil ransomware operators have threatened to auction off a vast amount of sensitive documents belonging to Grubman Shire Meiselas & Sacks's top clients. It laid out a schedule beginning on July 1, with documents from Mariah Carey, Nicki Minaj, and Lebron James followed two days later by Bad Boy Records, MTV and Universal, and then an unspecified one on July 5. The first three bids start at $600,000, Bad Boy is $750,000, and the latter two $1 million. The operators claim to have downloaded full information from the office, namely contracts, agreements, NDA, confidential information, court conflicts, and internal correspondence with the firm.

See the full report here: https://variety.com/2020/biz/news/mariah-carey-nicki-minaj-mtv-hackers-allen-grubman-1234648709/

Hakbit Ransomware Attack Uses GuLoader, Malicious Microsoft Excel Attachments - Threatpost

Researchers discovered a spear-phishing campaign targetting mid-level employees across Austria, Switzerland, and Germany. Threat actors are using malicious email attachments delivered from a free email provider GMX that primarily serves a European client base. Once opened, these malicious attachments drop GuLoader to compromise the target and install malware.

See the full report here: https://threatpost.com/hackbit-ransomware-attack-uses-guloader-malicious-microsoft-excel-attachments/156826/

Hackers target Canadians with fake COVID-19 contact-tracing app disguised as official government software - National Post

Threat actors using fake COVID-19 contact tracing app to target Canadians. The malicious app disguises as official government software and distributed through coronavirus-themed websites to trick the victims. Downloading the app activates hidden ransomware which encrypts all the files in the device.

See the full report here: https://nationalpost.com/news/canada/hackers-target-canadians-with-fake-covid-19-contact-tracing-app-disguised-as-official-government-software

Exposed Frost & Sullivan databases for sale on hacking forum

Sensitive data belonging to a U.S. business consulting firm Frost & Sullivan leaked on a hacking forum by a group KelvinSecurity Team. The breach occurred to a misconfigured backup directory on one of Frost and Sullivan's public-facing servers. The backup directory had its employees and customers records, along with other confidential information.

See the full report here: https://www.bleepingcomputer.com/news/security/exposed-frost-and-sullivan-databases-for-sale-on-hacking-forum/

Telegram: Breach Exposed Millions Of Users' Data - pymnts.com

Cointelegraph reported that the messaging app Telegram suffered a data breach after its database containing the personal information of millions of users exposed on a darknet forum. The leaked information included users’ phone numbers and unique Telegram user IDs. Telegram told Russian tech publication Kod[.]ru that the information exposed through the app’s built-in contact export feature while a user was registering. Telegram reportedly said that much of the leaked data was outdated as 84 percent of it was collected before mid-2019 and around 60 percent of it is inaccurate.

See the full report here: https://www.pymnts.com/news/security-and-risk/2020/telegram-breach-exposed-millions-user-data/

CryptoCore hacker group stole over $200M from cryptocurrency exchanges

According to security researchers from ClearSky, a hacker group tracked as CryptoCore, believed to be operating out of Eastern Europe, has stolen around $200 million from cryptocurrency exchanges. CryptoCore is a group that targets exclusively cryptocurrency exchanges and companies working with them via supply-chain attack. The main goal of CryptoCore operations is to gain access to cryptocurrency exchanges’ wallets. The group is not technically advanced and was responsible for five successful hacks in the United States, Japan, and the Middle East.

See the full report here: https://securityaffairs.co/wordpress/105168/cyber-crime/cryptocore-stole-200m-crypto-exchanges.html

New XORDDoS, Kaiji DDoS botnet variants target Docker servers

Trend Micro researchers detected variants of two existing Linux botnet malware types, XORDDoS malware, and Kaiji DDoS malware targeting exposed Docker servers. Botnet operators look for Docker servers that expose port 2375, which is one of the two ports of the Docker API used for unauthenticated and unencrypted communications. Upon compromising a Docker server, XORDDoS runs a series of commands to find containers and infect them with the DDoS malware. The XORDDoS gathers information about the compromised system, and it downloads and executes other payloads. Operators of the Kaiji bot scans the web for exposed Docker servers and deploy an ARM container that executed its binary. Kaiji also collects information about the compromised system to launch various types of DDoS attacks, including ACK, IPS spoof, SSH, SYN, SYNACK, TCP, and UDP attacks.

See the full report here: https://securityaffairs.co/wordpress/105134/breaking-news/xorddos-kaiji-ddos-botnet-docker.html

Self-Propagating Lucifer Malware Targets Windows Systems

Security researchers at Palo Alto Networks have discovered a self-propagating malware, dubbed Lucifer, which uses cryptojacking and distributed denial-of-service (DDoS) attacks to target Windows platforms. The malware exploits unpatched vulnerabilities on the target machine and then connects to C2 server and executes arbitrary commands which include performing a TCP, UDP, or HTTP DoS attack, allowing the malware to drop an XMRig miner and launch cryptojacking attacks, as well as collecting interface info and sending the miner status to the C2. The malware is also capable of self-propagation through either by brute force attacks or by exploiting EternalBlue, EternalRomance, and DoublePulsar exploits. Users are recommended to keep systems up-to-date and eliminate weak credentials to avoid such attacks.

See the full report here: https://threatpost.com/self-propagating-lucifer-malware-targets-windows-systems/156883/