Threat Intelligence Bulletin: 06/26/2020 - 07/02/2020

Telegram's Telegraph Service used for Scams

Alpha Team has observed a new tactic being used by Bitcoin "giveaway" scammers on social and digital platforms. Scammers are using YouTube "live" channels, with fake views and chat bots, to drive traffic to giveaway sites. These sites use Telegram's Telegraph service, which is a lightweight web page similar to Medium, that can be quickly recycled under the Telegraph service.

Recommendations

• Enable Impersonation protection for executives or influencers in your company to find scammers using their likeness

Details

Cryptocurrency giveaway scams are similar to money-flipping scams. The basic premise is that scammers will advertise a giveaway of cryptocurrency, usually impersonating an influencer in the cryptocurrency community or a celebrity, and the only way to enter the giveaway is to send the scammers money for a larger return.

These scams have been documented by a number of news and media outlets, as Alpha Team has been tracking these scams for close to 2 years. A recent article on Bitcoin.com outlined a Youtube scam with Elon Musk and 'live' channels advertising these attacks.

Figure 1: SpaceX Live Channels from Bitcoin.com article

Since 2018, scammers have adapted their TTPs to avoid detection. This includes using unicode characters in their tweet replies, which look like Latin characters to a human but are different interpretations of character codepoints to a computer. Then, scam text was embedded in a picture, where there was no text in posts advertising the scams. Migrating to Youtube where these scammers can abuse impersonation profiles, chat functionality and overlaying scam text in a streaming video make it harder for detection for the platforms.

Figure 2: Searching Youtube for Elon Musk and filtering by Live

Many of these sites embed a QR code for people to directly scan from their phone to send Bitcoin. These QR codes typically link to a landing site with a crypto wallet address as well as additional text explaining the giveaway. This is an efficient pretext as it attempts to increase legitimacy for the opportunity.

Figure 3: QR Code embedded over a pre-recorded video for the Giveaway

Figure 4: Landing site on Telegram's Telegraph Service for the Scam

Figure 4 shows a landing page on Telegram's Telegraph service. This service is an anonymous blogging platform, similar to Medium, that is maintained by Telegram. Scammers typically used other blog services, such as Blogspot or Medium, to host these scam pages, but they required an account. With Telegraph, scammers can quickly setup a page, so when one gets blacklisted, they can move to another.

Alpha Team performed a search on URLScan for any websites being submitted for the Telegraph service and downselected the results based on terms such as giveaway, bitcoin or influencer names. There has been a significant increase in sites being submitted to URLScan using the Telegraph service, indicating that scammers are moving infrastructure to this anonymous microblogging platform.

Figure 5: Telegraph submission in URLScan in the last 2 years

Based on the number of Youtube-live scams, the relative success of some of these wallet addresses, and the increase in Telegraph based scam landing pages, Alpha Team has HIGH confidence that this will continue to plague Youtube and the cryptocurrency community.

Breaking News: 2020-06-26 - 2020-07-02

Nvidia Warns Windows Gamers of Serious Graphics Driver Bugs

Graphics chipmaker Nvidia has fixed two high-severity security flaws tracked as CVE-2020-5962 and CVE‑2020‑5963 in its graphics drivers which could allow an attacker to view sensitive data, gain escalated privileges, or launch denial-of-service (DoS) attacks in impacted Windows gaming devices. Nvidia has also addressed four high-severity flaws in its Virtual GPU (vGPU) manager, tracked as CVE‑2020‑5968, CVE‑2020‑5969, CVE‑2020‑5970, and CVE‑2020‑5971 which could also allow an attacker to view sensitive data, gain escalated privileges, launch denial-of-service (DoS) attacks or can result in code execution. Windows users are recommended to patch the vulnerabilities.

See the full report here: https://threatpost.com/nvidia-windows-gamers-graphics-driver-bugs/156911/

Apple adds support for encrypted DNS (DoH and DoT)

Apple has announced the upcoming versions of its iOS and macOS iOS 14, and macOS 11, which will support the DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) protocols. Developers can create apps to apply DoH/DoT settings for the entire operating system via network extension apps or MDM profiles, to individual apps, or an app's selected network requests. Apple now joins the likes of Mozilla, Google, and Microsoft, all of whom have announced support for encrypted DNS communications in their respective products.

See the full report here: https://www.zdnet.com/article/apple-adds-support-for-encrypted-dns-doh-and-dot/

Hackers hide credit card stealing scripts in favicon EXIF data - BleepingComputer

According to Malwarebytes, an online store using the WordPress WooCommerce plugin was found to be infected with a Magecart script to steal customer's credit cards. When images are created, the developer can embed information, and its called the Exchangeable Image File Format (EXIF) data. The threat actors hide their Web skimmer within EXIF of an image file and append the skimmer toolkit’s source code into the compromised website. Once these scripts were loaded, any credit card information submitted on checkout pages is captured and transferred to the command-and-control server.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-hide-credit-card-stealing-scripts-in-favicon-exif-data/

Office 365 Users Targeted By ‘Coronavirus Employee Training’ Phish

Security researchers from CheckPoint have uncovered a new phishing campaign that targets Office 365 users. The phishing email purports to be coronavirus training resources to employees that contain a link to register for the training. The link redirects the victim to a malicious link, where they are asked to input their credentials, hence compromising their accounts.

See the full report here: https://threatpost.com/office-365-users-targeted-by-coronavirus-employee-training-phish/156899/

Chinese bank forced western companies to install malware-laced tax software - ZDNet

Cybersecurity firm Trustwave reported that a Chinese bank had forced two western companies, UK-based technology/software vendor, and a major financial institution, both had recently opened offices in China, to install malware-laced tax software on their systems. According to Trustwave, the software works as advertised, allowing its customer to pay local taxes, but it also installs a hidden backdoor GoldenSpy. The backdoor runs with system-level access, allowing a remote attacker to connect and run commands or upload and install other software. The company has alerted other companies doing business in China and using Intelligent Tax software.

See the full report here: https://www.zdnet.com/article/chinese-bank-forced-western-companies-to-install-malware-laced-tax-software/

Golang Worm Widens Scope to Windows, Adds Payload Capacity

Security researchers at Barracuda Networks have uncovered a new variant of the crypto miner malware known as Golang is targeting both Windows and Linux machines. This new malware variant attacks web application frameworks, application servers, and non-HTTP services such as Redis and MSSQL. Its goal is to mine Monero cryptocurrency using a known miner, XMRig. The malware spreads like a worm, searching, and infecting other vulnerable machines. Once the malware infects a machine, it downloads a set of files that are customized based on the platform it is attacking. The malware includes components that constantly check for updates and help persist the attack, the installed backdoor on Windows machines grants a high level of control to the operators.

See the full report here: https://threatpost.com/worm-golang-malware-windows-payloads/156924/

LG Electronics allegedly hit by Maze ransomware attack

Maze ransomware operators have added a new entry on their data leak site wherein they published alleged proofs of their attack on South Korean multinational LG Electronics. The screenshot includes a file listing from a Python code repository, a split archive for a '.KDZ file', which is the format for official stock firmware code from LG and a snippet of Python code for an email forwarding project. However, the company is yet to respond to the alleged attack.

See the full report here: https://www.bleepingcomputer.com/news/security/lg-electronics-allegedly-hit-by-maze-ransomware-attack/

DarkCrewFriends Returns with Botnet Strategy

Check Point security researchers have observed a hackers-for-hire group, DarkCrewFriends, that is targeting content management systems to build a botnet. The group exploits an unrestricted file upload vulnerability to compromise PHP servers that run websites. Once the victim machine is compromised, a malicious PHP web shell is installed as a backdoor, which in turn sets up a connection to a command-and-control server using an Internet Relay Chat (IRC) channel. The web shell on the victim’s server defines a GET parameter and executes a decompressed base64 string to download and execute two .AFF files. The .AFF files are PHP and Perl files, variants of the main malware module, which have capabilities to execute shell commands, gather information on running services on the host computer, download or upload FTP files, scan open ports, and conduct multiple types of DDoS attacks.

See the full report here: https://threatpost.com/darkcrewfriends-returns-botnet/156963/

8 U.S. City Websites Targeted in Magecart Attacks

Security researchers at Trend Micro have reported websites of eight U.S cities that have been compromised with payment card-stealing Magecart skimmers. The researchers believe that these attacks started on April 10 of this year, and are still active. Unlike other skimmers, the one used in this incident appears to only target website payment forms by Click2Gov. Click2Gov software is used in self-service bill-paying portals used by utilities and community development organizations for things such as paying parking tickets online. The attack occurs when victims make an online payment on the compromised Click2Gov website, embedded with a JavaScript code. When victims browse the payment page and click the submit button, injected code loads a credit card skimmer and grabs the information from the selected columns in the payment form and sends the collected information to a remote server via an HTTP POST request.

See the full report here: https://threatpost.com/8-city-gov-websites-magecart/156954/

Hackers breach E27, want "donation" to reveal vulnerabilities - BleepingComputer

An Asian media firm, E27, was hacked by a group named "Korean Hackers" and "Team Johnwick". The attackers demanded a small "donation" to provide information on the vulnerabilities used in the attack. The group claims to have stolen source code and a database containing emails, mobile, passwords, other docs, profile images, etc. The firm has confirmed the incident and stated that it does not store any credit card or payment-related information on the server. Users are recommended to change their passwords on the site as well on other sites where the same password is used.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-breach-e27-want-donation-to-reveal-vulnerabilities/

New Ransom X Ransomware used in Texas TxDOT cyberattack - BleepingComputer

A new ransomware called Ransom X is being actively used in human-operated and targeted attacks against government agencies and enterprises. According to the samples found by the MalwareHunter Team, TxDot suffered an attack by new targeted ransomware called Ransom X. As this is human-operated ransomware, rather than one distributed via phishing or malware, when executed the ransomware would open a console that displays information to the attacker while it is running. It would then terminate processes related to security software and bypass specific Windows system folders. By bypassing these folders, it allows the attackers to encrypt a computer while attacking other computers on the network without fear their tools will become encrypted. The ransomware encrypts all the data on the computer and appends a custom extension associated with the victim to each encrypted file. Currently, the activity of the ransomware is under investigation.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/

TikTok To Stop Clipboard Snooping After Apple Privacy Feature Exposes Behavior

A new privacy feature in Apple iOS 14 restricts TikTok’s practice of reading iPhone users’ cut-and-paste data. Apple added a new banner alert to iOS 14 that lets users know if a mobile app is pasting from the clipboard and thus able to read to a user’s cut-and-paste data. After complaints from many users, TikTok responded that the app is not collecting data from the clipboard, but rather is triggering the iOS privacy banner through a custom system that identifies repetitive spam behavior. The company said it would correct this problem in a future update.

See the full report here: https://threatpost.com/tiktok-to-stop-clipboard-snooping-after-apple-privacy-feature-exposes-behavior/156945/

Hackers target J&K Power Development Dept, wipe out essential data - India TV News

Essential data belonging to J&K Power Development Department was wiped out from the servers in a cyberattack. Hackers compromised four servers and blocked access to them. Following the incident, all network data lines were closed to stop the hackers from accessing further data. The department has suspended its operations and the data recovery is in progress. Officials of the department have also lodged a complaint in this regard with the police's cybercrime cell. It is currently not known if any data was exfiltrated during the cyberattack.

See the full report here: https://www.indiatvnews.com/technology/news-hackers-target-j-k-power-development-dept-wipe-out-essential-data-629779

Evil Corp blocked from deploying ransomware on US companies - BleepingComputer

The Evil Corp gang was blocked from deploying WastedLocker ransomware payloads in dozens of attacks against major US corporations, including Fortune 500 companies. According to Symantec, Evil Corp's attacks were directed at a wide range of industry sectors and at least 31 customer organizations were attacked. The attackers had breached the networks of targeted organizations and were in the process of laying the groundwork for staging ransomware attacks but fortunately, they were disrupted. Attacks that could have led to millions in damages, downtime and a possible domino effect on supply chains were prevented successfully.

See the full report here: https://www.bleepingcomputer.com/news/security/evil-corp-blocked-from-deploying-ransomware-on-us-companies/

Almost 300 Windows 10 executables vulnerable to DLL hijacking - BleepingComputer

A PwC UK security researcher has discovered that almost 300 executables in the System32 folder are vulnerable to relative path DLL Hijacking, where an attacker can cause a legitimate Windows executable to load an arbitrary DLL of the attacker’s choice, most likely with malicious intent. DLL hijacking attacks can prove useful to a skilled attacker as they grant capabilities such as arbitrary code execution, privilege escalation, and persistence on the target system. The researcher has demonstrated the flaw using a simple VBScript where some of the EXEs can be used to elevate such executions, bypassing UAC entirely. The researcher has also presented a few prevention methods that can be used to stop such attacks in his report.

See the full report here: https://www.bleepingcomputer.com/news/security/almost-300-windows-10-executables-vulnerable-to-dll-hijacking/

GeoVision access control devices let hackers steal fingerprints - BleepingComputer

GeoVision, a Taiwanese fingerprint scanner, access control, and surveillance tech manufacturer, was vulnerable to numerous flaws in its devices that could allow users to gain full and unauthorized access to the cameras which could be exploited by nation-state actors to intercept traffic and conduct espionage. The vulnerabilities include a backdoor password with admin privileges, the reuse of cryptographic keys, and the disclosure of private keys to everyone and are tracked as include CVE-2020-3928, CVE-2020-3930, and CVE-2020-3929. GeoVision has fixed these critical vulnerabilities and confirmed the availability of the new version (v. 1.22).

See the full report here: https://www.bleepingcomputer.com/news/security/geovision-access-control-devices-let-hackers-steal-fingerprints/

Big-name Connecticut legal firm takes a hit from Sekhmet ransomware - iTWire

Sekhmet ransomware group has attacked the Coles, Baldwin, Kaiser & Creager (CBK) law firm, one of the biggest legal firms based in Connecticut. The clients of CBK Law include Admiral Insurance Company, Aetna Casualty & Surety Co., American Red Cross, Bechtel Corporation, Business Training Systems, Inc., Christian Life Church, City of Middletown, City of Milford, City of Shelton, CNA Insurance Companies, Connecticut Interlocal Risk Agency, and many more. The threat actor group compromised multiple servers and threatened to leak confidential information on their shamming site if the law firm fails to pay the ransom. The company is yet to respond to the incident.

See the full report here: https://www.itwire.com/security/big-name-connecticut-legal-firm-takes-a-hit-from-sekhmet-ransomware.html

Apple strong-arms entire CA industry into one-year certificate lifespans

Starting September 1, 2020, browsers and devices from Apple, Google, and Mozilla will show errors for new TLS certificates that have a lifespan greater than 398 days. The primary reason behind this is that bad TLS certificates get cycled out faster. If a TLS certificate has been abused for malware, phishing, or other operations, the certificate must be revoked by Certificate Authorities (CAs). However, in practice, very few CAs revoke certificates in time, leaving bad certificates valid for years, allowing bad guys to use and re-use the same certificate for multiple operations. Therefore, following September 1, 2020, website owners will have to renew TLS certificates yearly, instead of two years.

See the full report here: https://www.zdnet.com/article/apple-strong-arms-entire-ca-industry-into-one-year-certificate-lifespans/

Adobe, Mastercard, Visa warn online store owners of Magento 1.x EOL

The Visa and Mastercard payment processors, along with Adobe, have warned the online store owners to update their Magento 1.x platforms as it will reach its end-of-life (EOL) on June 30, after which Adobe plans to stop offering security updates. Almost 110,000 online stores are still running the soon-to-be-outdated Magento 1.x CMS. With hackers exploiting Magento bugs constantly to breach stores and insert payment card-stealing code in checkout forms, any new Magento 1.x exploit will be a disaster for the online store market. Users of Magento 1.x platforms are urged to update to the latest 2.x branch to prevent risks.

See the full report here: https://www.zdnet.com/article/adobe-mastercard-visa-warn-online-store-owners-of-magento-1-x-eol/

iOS 14 beta shows apps like TikTok still spy on your iPhone clipboard - Mashable

The newest iPhone operating system, iOS 14, has a new way to notify users about apps looking at their iPhone data as the clipboard privacy issue on iPhones is still running wild on more than 50 apps, including TikTok, numerous news apps, and games like Bejeweled. The clipboard privacy breach was first reported in March and exposed that some apps could see iPhone users' clipboard contents, which could be a credit card number, password, or any random link. The iOS 14 was introduced at Apple's Worldwide Developers Conference in June 2020 and beta users immediately noticed that the clipboard spying is still happening on some apps. The iOS 14 public beta is scheduled to be out in July and the official release will soon be made available.

See the full report here: https://mashable.com/article/iphone-ios-14-privacy-clipboard-apple-apps/

A hacker gang is wiping Lenovo NAS devices and asking for ransoms

In a new campaign, LenovoEMC network-attached storage (NAS) devices are being targeted by a hacker group called 'Cl0ud SecuritY'. After breaking into the device, the attackers wipe files and drop ransom notes signed with the 'Cl0ud SecuritY' monicker, asking owners to pay between $200 and $275 to get their data back. Attacks appear to have targeted only LenovoEMC/Iomega NAS devices that are exposing their management interface on the internet without a password. According to researchers and current evidence, the ransom notes appear to carry empty threats, and their role seems to be to scare victims into paying a ransom demand for data hackers have already wiped.

See the full report here: https://www.zdnet.com/article/a-hacker-gang-is-wiping-lenovo-nas-devices-and-asking-for-ransoms/

Roblox accounts being hacked in support of Trump reelection - BleepingComputer

A new hacking campaign has been identified in which attackers are targeting Roblox, a popular gaming platform, to support President Trump in the upcoming U.S. Presidential elections in November. The attackers hack into Roblox accounts by brute-forcing weak passwords and target children by modifying the About section of their profile to read, "Ask your parents to vote for Trump this year! #MAGA2020." Roblox players can customize their gaming experience, purchase skins that change the appearance of their in-game avatar using t-shirts, hats, and other accessories. As part of this attack, the hacker will purchase two free clothing skins and add them to the hacked account's avatar to represent what the hacker perceives as a President Trump supporter. Currently, there are now close to 1,000 accounts indexed in Google that have been hacked. Impacted Roblox users are urged to change their account passwords to a more complex one.

See the full report here: https://www.bleepingcomputer.com/news/security/roblox-accounts-being-hacked-in-support-of-trump-reelection/

Palo Alto Networks fixes a critical flaw in firewall PAN-OS

Palo Alto Networks has addressed a critical vulnerability found in the operating system (PAN-OS) of all its next-generation firewalls that could allow unauthenticated network-based attackers to bypass authentication. The vulnerability tracked as CVE-2020-2021 has been rated critical with a CVSS 3.x base score of 10, and it could be exploited by threat actors with network access to vulnerable servers as part of low complexity attacks. Palo Alto has patched the critical vulnerability and users are urged to update to the latest fixed versions.

See the full report here: https://securityaffairs.co/wordpress/105351/hacking/critical-flaw-firewall-pan-os.html?utm_source=rss&utm_medium=rss&utm_campaign=critical-flaw-firewall-pan-os

This Registry trick lets you block major Windows 10 updates - BleepingComputer

On Windows 10, feature updates and quality updates download and install automatically as soon as they’re ready. With Windows 10's May 2019 Update, Microsoft introduced the ability to defer all Windows 10 updates, including feature updates, for up to 35 days via the Windows Update settings. A new Windows policy called 'TargetReleaseVersionInfo' that prevents Windows 10 feature updates from being installed. While users can still manage update deferrals using Group Policy. Windows Registry feature is available in Windows 10 version 1803 or newer.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/this-registry-trick-lets-you-block-major-windows-10-updates/

Seller floods hacker forum with data stolen from 14 companies

A data breach broker is selling databases containing user records for 14 different companies he claimed were breached by hackers in 2020. The databases currently being sold include game sites, food delivery services, Soccer streaming, online fashion, and loans and contains different information, but they all include usernames and hashed passwords. The data breaches look legitimate. However, the companies have not confirmed yet.

See the full report here: https://www.bleepingcomputer.com/news/security/seller-floods-hacker-forum-with-data-stolen-from-14-companies/

Microsoft officially launches Windows 10 Insider channels

On Monday, Microsoft announced that the new Windows Insider Channels are rolling out to Windows 10 customers enrolled in Windows 10 Insider Program. Windows Insiders devices will be automatically moved to channels based on the currently selected ring and on the quality of the experienced they are expecting, without any user interaction. The Fast and Skip Ahead rings will become the Dev Channel, the Slow ring will shift to the Beta Channel, and the Release Preview ring will be converted into the Release Preview Channel. Windows Insiders won't notice any changes outside of the new names. Functionally, each channel will continue to operate as its corresponding ring did previously. The company stated that the new Insider channels will get new builds and updates, frequently.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-officially-launches-windows-10-insider-channels/

Google Cloud brings Bare Metal Solution to new regions

Last November, Google announced Bare Metal Solution, which lets businesses run specialized workloads lowering overall costs and reducing risks associated with migration. On Monday, the company announced the availability of Bare Metal Solution in five more regions: Ashburn, Virginia; Frankfurt; London; Los Angeles, California; and Sydney. By the end of 2020, it will also be available in Amsterdam, São Paulo, Singapore, and Tokyo.

See the full report here: https://www.zdnet.com/article/google-cloud-brings-bare-metal-solution-to-new-regions/

Google Will Delete Your Data by Default—in 18 Months

Just after Apple announced new security and privacy features, Google announced its privacy-focused improvements. The primary announcement concerns Google Location History and a new 18 month, default auto-delete policy, Web & App activity auto-delete will also default to 18 months for new accounts, for new YouTube accounts auto-delete will be set to 36 months. Users of existing accounts will maintain their current settings and will need to manually adjust them. Google clarifies that default retention periods will not apply to other products like Gmail, Drive, and Photos, which are designed to safely store users' content.

See the full report here: https://www.wired.com/story/google-auto-delete-data/

SAQ computers hacked, personal data of employees consulted - Globalnews.ca

The Société des alcools du Québec (SAQ), a provincial Crown corporation in Quebec responsible for the trade of alcoholic beverages within the province, was the target of a hacking attempt. The intrusion took place on May 15, 2002, and the company speculates that the information of a few employees might have been compromised. The leaked data possibly includes social insurance number, name, address, date of birth, and weekly payroll for both active and inactive employees. The breach was quickly detected and blocked by the SAQ’s computer monitoring tools. The affected employees will be contacted by the SAQ and offered credit monitoring and identity theft insurance service for one year with Equifax.

See the full report here: https://globalnews.ca/news/7126504/saq-hacked-personal-data/

FakeSpy Android malware targets Royal Mail app users - ComputerWeekly.com

Cybereason’s threat research team has discovered an upgraded version of the FakeSpy Android malware family which is actively exploiting the brands of postal services companies in many countries including France’s La Poste, Germany’s Deutsche Post, and the US Postal Service, as well as Royal Mail in the UK. FakeSpy relies on SMS phishing wherein attackers send fake text messages to lure targets into clicking on a malicious link which indeed downloads app containing FakeSpy. Once installed and opened, it prompts to permit interception, read every SMS received on the device, and ignore battery optimization features. It then exfiltrates data from the device, including details of SMS messages, phone numbers and contact books, device information, data related to any banking or cryptocurrency apps, and any information in the national public key infrastructure (NPKI) folder.

See the full report here: https://www.computerweekly.com/news/252485404/FakeSpy-Android-malware-targets-Royal-Mail-app-users

Google warns G Suite users: Update these mobile apps now or they may stop working

Google has warned that older G Suite apps will stop working in August. The versions of the apps released before December 2018 are more likely to be impacted by changes rolling out. The admins should encourage users to upgrade multiple iOS and Android apps. The issues affect G Suite customers and users of Google's mobile apps with a personal Google account. Users should also update the Drive File Stream desktop app and the Gmail iOS app.

See the full report here: https://www.zdnet.com/article/google-warns-g-suite-users-update-these-mobile-apps-now-or-they-may-stop-working/

Microsoft releases OOB security updates for Windows 10 RCE bugs - BleepingComputer

Microsoft has released two out-of-band security updates to address remote code execution flaws in Microsoft Windows Codecs Library on several Windows 10 and Windows Server versions. The vulnerabilities are tracked as CVE-2020-1425 and CVE-2020-1457 and reside in the way that Microsoft Windows Codecs Library handles objects in memory. The exploitation of CVE-2020-1425 can allow attackers to obtain information to further compromise the user’s system, while successful exploitation of CVE-2020-1457 could lead to arbitrary code execution on vulnerable systems. Microsoft has stated that the affected customers will be automatically updated by Microsoft Store.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-releases-oob-security-updates-for-windows-10-rce-bugs/

Clever Phishing scam targets websites with free DNSSEC offer - BleepingComputer

Security researchers have identified a new phishing campaign that targets bloggers and website owners with emails pretending to be from their hosting provider. Hosting companies impersonated include HostGator, HostMonster, KonaKart, Linode, Magento, Microsoft Azure, NameCheap, and Network Solutions. The campaign begins with targets receiving the phishing emails from their hosting provider who wants to upgrade their domain to use secure DNS (DNSSEC). These emails are embedded with malicious links that redirect to an Update Assistant page, using which the scammers steal credentials. Once the user enters their credentials, the malicious website pretends to kick off a series of installation and update sequences, using fake AJAX-style loaders and popup alerts, imitating an installation. People are urged to verify the authenticity of suspicious emails before interacting with them.

See the full report here: https://www.bleepingcomputer.com/news/security/clever-phishing-scam-targets-websites-with-free-dnssec-offer/

Firefox 78 adds WebRender support to Windows PCs with Intel GPU - BleepingComputer

Mozilla has released Firefox 78 on June 30, 2020, to the Stable desktop channel for Windows, macOS, and Linux with new features, bug fixes, and improvements. The highlighting features include the addition of WebRender improvements for Windows 10 devices with an Intel GPU, error pages for all sites that do not provide support for TLS 1.2, and a new Refresh option in the Firefox uninstaller. The WebRender with GPU-based engine will allow smoother animations, faster page rendering, special visual effects, as well as complex gradients. Windows, Mac, and Linux desktop users can upgrade to Firefox 78 and the browser will automatically check for the new update and install it when available.

See the full report here: https://www.bleepingcomputer.com/news/software/firefox-78-adds-webrender-support-to-windows-pcs-with-intel-gpu/

Business giant Xerox allegedly suffers Maze Ransomware attack - BleepingComputer

Maze ransomware operators have updated their list of victims, adding Xerox Corporation to the roster. Xerox Holdings Corporation is a US-based organization that sells print and digital document products and provides services in more than 160 countries. The attackers claim to have stolen more than 100GB of data and posted a set of 10 screenshots publicly, showing directory listings from June 24 and 25, network shares, and the ransom note that is dropped after the encryption routine completes. The company is yet to confirm the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/business-giant-xerox-allegedly-suffers-maze-ransomware-attack/

New EvilQuest ransomware discovered targeting macOS users

Security researchers have discovered a new ransomware strain targeting macOS users. Named OSX.EvilQuest, the ransomware has the capability to not only encrypt users’ data, but also install a keylogger, a reverse shell, and steal cryptocurrency wallet-related files from infected hosts. The ransomware was first reported on June 29. However, new evidence revealed that the malware has been distributed in the wild since the start of June 2020. Researchers spotted samples of EvilQuest in a software package called Google Software Update, pirated version of popular DJ software Mixed In Key aned macOS security tool called Little Snitch. The ransomware is believed to be broadly distributed, leveraging many more other apps, and not just these three.

See the full report here: https://www.zdnet.com/article/new-evilquest-ransomware-discovered-targeting-macos-users/

Hacked Balancer platform promises to refund users who lost funds - CoinGeek

Balancer, a DeFi platform that provides non-custodial portfolio management, liquidity, and price sensor services, was hacked for around $450,000 on June 29. The attacker used the funds from the FlashLoan to swap WETH between STA tokens. On each trade, STA has a transfer fee and the pool expects it receives a balance without the fee. After enough calls, the attacker calls gulp() which syncs the internal pool accounting of a token balance to the actual balance as stored in the token tracker contract. As the balance of STA is close to zero, its price relative to the other tokens is extremely high and the attacker can now use STA to swap for other assets in the pool extremely cheaply. The company has announced that it will be reimbursing the liquidity providers who lost funds due to the hack.

See the full report here: https://coingeek.com/hacked-balancer-platform-promises-to-refund-users-who-lost-funds/

Windows 10 PowerToys 0.19 released in huge stability bug fix - BleepingComputer

Microsoft has released PowerToys version 0.19 that fixed over 100 issues to improve stability and performance. Windows PowerToys, are a set of small freeware utilities created by Windows developers to add extra functionality to Windows 10 or solve everyday tasks. The bulk of the issues fixed were in the PowerToys Run app, which can now correctly detect Steam games, hidden files, and Terminal.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-powertoys-019-released-in-huge-stability-bug-fix/

Facebook says 5,000 app developers got user data after cutoff date

Facebook disclosed a new user privacy incident wherein the issue enabled approximately 5,000 developers to continue receiving user information. They added a feature in its API that prevented apps from accessing a user's data if the user did not use the app for more than 90 days. However, they recently discovered that in some instances, the safety mechanism failed to activate and allowed some apps to continue accessing user information even past the 90-day cutoff date. The company has not clarified how many users were impacted. However, they confirmed that the issue is fixed.

See the full report here: https://www.zdnet.com/article/facebook-says-5000-app-developers-got-user-data-after-cutoff-date/

Hackers still abusing two-year-old Microsoft Office exploit - ITProPortal

According to Menlo labs, attackers are continuing to exploit CVE-2017-11882, an old Microsoft exploit with a patch that was issued more than two years ago. The vulnerability used in the attacks exists in Microsoft's Equation Editor in Office that enables users to embed mathematical equations or formulas inside any office document. Microsoft patched all versions of Microsoft Office for this vulnerability. This gave rise to two newer versions of exploits targeting the Equation Editor, CVE-2018-0802—Targets the equation editor, but only works on the versions that were patched for CVE-2017-11882 and CVE-2018-0798—Targets the equation editor, but works on all versions. Users using unpatched versions are recommended to patch the vulnerabilities.

See the full report here: https://www.itproportal.com/news/hackers-still-abusing-two-year-old-microsoft-office-exploit/

New Android Spyware Tools Emerge in Widespread Surveillance Campaign

Researchers have uncovered a surveillance campaign that used a slew of Android tools to spy on the Uyghur ethnic minority group. The campaign started in 2013 and three new Android tools, SilkBean, GoldenEagle and CarbonSteal, and one previously disclosed tool, DoubleAgent to gather and exfiltrate personal user data to attacker-operated command-and-control (C2) servers. The malware families were used in widespread campaigns that originated in China, which predominantly targeted Uyghurs, but also, to a lesser extent, Tibetans. Each of the four malware tools involved in the campaign has its own unique data gathering priorities and techniques. SilkBean tool comes with RAT functionality that enables an attacker to execute over 70 different commands on an infected device includes collecting, modifying, and sending messages, as well as recording the device screen. The newer versions of DoubleAgent upload unencrypted files directly to the C2 servers using TCP sockets. CarbonSteal spyware has audio recording functionality in a variety of codecs and audio formats. It can control infected devices through specially crafted SMS messages. GoldenEagle functionalities include sniffing out contact info, call history and installed apps, taking screenshots, location tracking, and getting messages from China messaging services like WeChat.

See the full report here: https://threatpost.com/four-android-spyware-tools-surveillance-campaign/157063/