Threat Intelligence Bulletin: 07/03/2020 - 07/09/2020

Using DRP for Vulnerability Intelligence

The security community misses the mark from time to time when it comes to vulnerability impact. In the last week of June and the first week of July, security practitioners identified vulnerabilities in two critical networking devices with CVSS scores of 10. Typically, these vulnerabilities cause a lot of chatter and information sharing on digital platforms such as social media, dark web and code sharing websites. Using this information as enrichment points with security or IT team’s vulnerability prioritization patching process can be beneficial. Separating the hype from chatter versus actual exploitation in the wild can help reduce the stress on a security team on how rapidly they need to patch.

Recommendations

• Follow recommendations from vendors on how to mitigate vulnerabilities
• Use a thorough and well-rounded vulnerability management program to effectively prioritize vulnerabilities
• Stay up-to-date with news sources, including social media, on the latest vulnerabilities and how they may impact you and your business

Details

In this post, we will compare and contrast two vulnerabilities, CVE-2020-5902 and CVE-2020-2021, and their overall popularity on social media, and use social media as a pivot point to investigate other data sources. We will also compare the timing of the release of the vulnerabilities, which potentially had an impact on patch cycles and chatter, as well as give our assessment on which of the two should have been patched or mitigated first.

CVE-2020-5902, a vulnerability in BIG-IP F5 Networks TMUI, was announced on 7/1/2020, and a sharp increase of social media mentions throughout the discovery of POC’s, in the wild exploits, and patches.

Figure 1: Tweet activity related to CVE-2020-5902

Shortly after the initial announcement, the tweets revolved around the following timeline of notable events:

07/01/2020 - F5 Networks disclosed vulnerability in K52145254 07/03/2020 - Security teams started seeing active exploitation attempts 07/05/2020 - RCE POC disclosed on Twitter 07/05/2020 - Exploit added to Metasploit 07/06/2020 - Metasploit exploitation being seen in the wild 07/07/2020 - Researchers confirm bypass of initial F5 mitigation

With every major event, we saw more and more tweets discussing this vulnerability, along with when proof of concepts were disclosed, as well as when it was added to Metasploit as an official module, and closing with researchers seeing threat actors use that Metasploit module and bypass the mitigations suggested by F5.

By monitoring Github for the vulnerability, dozens of repos were created analyzing the vulnerability, along with screencasts and PoC code to exploit the vulnerability.

Figure 2: Github Repositories of CVE-2020-5902 POC code

The first repo with valid PoC code was released the same day on Github as the Metasploit module.

On a Russian-based dark web hacking and cybercrime forum, there were multiple threads and even nmap NSE scripts shared for this vulnerability.

Figure 3: Dark Web forum with discussions about vulnerability

Figure 4: Dark Web forum posting about CVE-2020-5902

Our assessment is that although the initial unique count of social chatter was low, the vulnerability got more attention as soon as researchers started contributing data around their honeypots, in the wild exploits, as well as their own PoCs. The vulnerability was also disclosed mid-week on a holiday week with the US, and this perhaps had an impact on its popularity, as well as potential fatigue from the previous week from the PAN-OS vulnerability.

CVE-2020-2021 (PAN-OS: Authentication Bypass in SAML Authentication) had a larger initial spike in tweets when the vulnerability was announced. Within two days, however, there was a dropoff in interest, perhaps due to the F5 bug.

Figure 5: Tweet activity related to CVE-2020-2021

Monitoring Github for the vulnerability identifier yielded much fewer results than CVE-2020-5902. In fact, the only repository that returns contains a description of it being a PoC, but it is only a rickroll:

Figure 6: Github repository for CVE-2020-2021 code

As of 9 July 2020, there has been no PoC observed in any of these digital platforms or reports of exploits in the wild. There has not been a significant dark web-based chatter about the vulnerability, specifically related to actors asking for PoCs or publishing them.

Unlike its F5 counterpart, the vulnerability in CVE-2020-2021, although trivial, doesn’t have the same return on investment post-infection as an unauthenticated LFI or RCE. This could be due to the weaponization of CVE-2020-2021 requires a post-infection workflow to obtain shell access, whereas the current vulnerability is a login bypass to an admin screen in PAN-OS. The unfortunate-yet-fortunate release of the F5 vulnerability two days later could have also removed interest in this vulnerability.

Conclusion

When prioritizing vulnerabilities, you should be looking at a variety of factors, and digital platforms can help do the work for you and provide that data in most cases. Overall, it is our assessment the clear winner in terms of bigger impact is the F5 vulnerability. But, initial interest was low with the vulnerability, but it started to become higher as soon as PoCs were made and exploits were seen in the wild.

When considering a vulnerability intelligence strategy, its important to have a strategy in keeping a pulse on the security community (cybercriminals and researchers alike) to help inform your decision to patch. Just because two vulnerabilities are CVSS-10 does not make them the same, just that the score could not get any higher within the CVSS model. Some key points of data we can glean from the digital content include:

• How many vulnerable devices are exposed on the open web?
• Has a POC been released by researchers, or has it been released by actors on the dark web?
• Are researchers talking about exploits in the wild on social media?
• Are cybercrime actors or forums talking about weaponizing the vulnerability, or are they - selling the weaponization?
• Are there official PoCs from Metasploit, or are there entries for the PoC on code sharing websites or exploit-db?
• What verticals are being targeted by this exploit?
• What are the IOC’s related to this vulnerability and the people who are exploiting it?
• Are there new methods of exploitation that we need to patch or mitigate?

Breaking News: 2020-07-03 - 2020-07-09

Sixteen Facebook apps caught secretly sharing data with third-parties

A team of academics has described a method that can help identify when Facebook app developers surreptitiously share user data with third parties, named as CanaryTrap. CanaryTrap revolves around the concept of honeytokens that represent fake data, tokens, or files that IT experts plant across their network. When the data is accessed or used, administrators can detect malicious activity. The academics used unique email addresses as honeytokens to register and install Facebook App, used it, and uninstalled the app from the account. They observed email addresses used to check in Facebook accounts received emails from third-parties. This technique was tested on 1,024 Facebook apps and identified 16 apps sharing users’ email addresses with third-parties. Users are advised to be vigilant in using Facebook apps.

See the full report here: https://www.zdnet.com/article/sixteen-facebook-apps-caught-secretly-sharing-data-with-third-parties/

Windows 10 background image tool can be abused to download malware

A binary in Windows 10 responsible for setting an image for the desktop and lock screen can help attackers download malware on a compromised system without raising the alarm. Known as living-off-the-land binaries (LoLBins), these files come with the operating system and have a legitimate purpose. Attackers are abusing them in post-exploitation phases to hide malicious activity. An attacker can use LoLBins to download and install malware, bypass security controls such as UAC or WDAC. If used successfully, an attacker can use LOLBins to make their attacks more difficult to trace or make their malware linger for longer on the victim machine.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-10-background-image-tool-can-be-abused-to-download-malware/

Maze Ransomware operators hacked Highways Authority Of India (Nhai)

A ransomware attack on the NHAI email server took place on Sunday night. According to the Indian Agency, no data was stolen. The Authority had shut down the server in response to the intrusion. Maze ransomware operators claim to have leaked only 5% (around 2GB) of the total volume of data exfiltrated by the Authority. According to Cyble, the data is sensitive to corporate operational documents.

See the full report here: https://securityaffairs.co/wordpress/?p=105467

Cisco Warns of High-Severity Bug in Small Business Switch Lineup

Cisco has reported a high-severity flaw affecting more than a half-dozen of its small business switches. Tracked as CVE-2020-3297, the flaw could allow remote, unauthenticated attackers to access the switches’ management interfaces with administrative privileges. Series Smart Switches, Series Managed Switches and Series Stackable Managed Switches are affected by this vulnerability. Cisco has fixed the issue in firmware release 2.5.5.47 that will be applicable for the 250 Series Smart Switches, 350 Series Managed Switches, 350X Series Stackable Managed Switches, 550X Series Stackable Managed Switches. However, the Small Business 200 Series Smart Switches, Small Business 300 Series Managed Switches and Small Business 500 Series Stackable Managed Switches have passed the end-of-software-maintenance milestone, so Cisco will not provide a firmware fix.

See the full report here: https://threatpost.com/cisco-warns-high-severity-bug-small-business-switch/157090/

Hacker ransoms 23k MongoDB databases and threatens to contact GDPR authorities

A hacker has uploaded ransom notes on 22,900 MongoDB databases that were left exposed online without a password. The hacker used an automated script to scan for misconfigured MongoDB databases, wipe their content, and leave a ransom note behind asking for a 0.015 bitcoin payment. If the companies failed to pay the ransom, the attackers threatened to leak the data and then contact the victim's local General Data Protection Regulation (GDPR) enforcement authority to report their data leak.

See the full report here: https://www.zdnet.com/article/hacker-ransoms-23k-mongodb-databases-and-threatens-to-contact-gdpr-authorities/

Windows POS malware uses DNS to smuggle stolen credit cards - BleepingComputer

A Windows Point-of-Sale (POS) malware has been discovered using the DNS protocol to smuggle stolen credit cards to a remote server under the attacker's control. Usually, a POS malware is installed on the point of sale systems to monitor for payments using credit cards, steal payment details and send it back to the C&C server. To protect against such attacks, the POS systems are secured by restricting them to connect to specific protocols, including HTTP. However, the DNS protocol is not commonly blocked as it is required for a variety of Windows services. The new Alina POS malware leverages this and uses encoded DNS requests to communicate with its command and control server. Organisations are advised to monitor DNS traffic for repeated suspicious queries.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-pos-malware-uses-dns-to-smuggle-stolen-credit-cards/

Microsoft Defender ATP now helps secure network devices

Microsoft Defender Advanced Threat Protection (ATP) uses a new feature dubbed Microsoft Secure Score for Devices to assess the security state of enterprise networks dynamically, identify unprotected systems and provide recommended actions to boost the overall security of an organization's endpoints. The score for devices is visible in the Threat & Vulnerability Management dashboard of the Microsoft Defender Security Center. A higher Microsoft Secure Score for Devices means your endpoints are more resilient from cybersecurity threat attacks. At the moment, Microsoft Secure Score for Devices supports configurations set via Group Policy. To improve endpoints' overall network security, users have to remediate the issues added to the security recommendations list that improves Microsoft Secure Score for Devices and makes it easier to secure an organization's entire network against vulnerabilities and cybersecurity threats.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-defender-atp-now-helps-secure-network-devices/

Holy Guacamole! Researchers find Apache remote desktop software was silently pwnable for snooping on sessions

Checkpoint researchers have identified flaws in Apache’s popular open-source remote desktop software Guacamole. Tracked as CVE-2020-9497 and CVE-2020-9498, the reverse RDP flaws allowed a compromised host to transmit malware to a clean client machine opening a remote desktop protocol (RDP) session with it. Apache has rolled out patches to mitigate these vulnerabilities.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/07/02/apache_guacamole_vulns_hijackable_rdp/

V Shred data leak exposes PII, sensitive photos of fitness customers and trainers

Security researchers at vpnMentor disclosed a data breach of the fitness brand V Shred, where an unsecured AWS S3 bucket exposed the PII of at least 99,000 individuals. Las Vegas-based V Shred is a company that offers fitness plans for women and men, with a focus on fast workouts, nutrition plans, and supplements. It has clients in 119 countries, 12 million unique visitors to its website per month, and over 40,000 subscribers to its university program. The unsecured bucket was first discovered on May 14, originally containing 1.3 million files, with a total of 606 GB data. The exposed data included names, home addresses, email addresses, dates of birth, some Social Security numbers, social media accounts details, usernames and passwords, age ranges, genders, and citizenship status, among other data points. Additionally, the open bucket also contained before-and-after photos of members, some of which could be deemed sensitive.

See the full report here: https://www.zdnet.com/article/v-shred-data-leak-exposes-pii-sensitive-photos-of-fitness-customers-and-trainers/

Essential Components For An Effective Digital Risk Protection (DRP) Program

A Digital Risk Protection (DRP) program can protect organizations from cyber and physical threats, brand impersonations. An effective DRP program enables an organization to respond quickly to digital threats by taking down fraudulent websites, ads, and social media accounts, notifying review sites and online forums about false and misleading postings, and alerting online marketplaces and app stores to counterfeit merchandise and fake mobile apps. To ensure your DRP program is an effective threat detector, analyzer, and remediator for your business, its recommended to consider Artificial intelligence-based tools for advanced analysis, Global threat intelligence and research, Automation, and ease of management are part of the solution.

See the full report here: https://www.zerofox.com/blog/essential-components-for-an-effective-digital-risk-protection-program/

New Apple macOS Big Sur feature to hamper adware operations

With macOS 14, also known as Big Sur, scheduled to release later this fall, Apple has removed the ability to install macOS profile configurations from the command-line as it has been abused by malware gangs or adware strains. The attackers used this ability because it was silent and did not need any type of user interaction. However, with macOS 14 and going forward, the "silent installation" loophole has been removed. This turns a "silent" malware installation method into an attack that requires "social engineering" to trick users into visiting the profile settings page and approving the operation which is something that many users will spot as a potentially dangerous operation.

See the full report here: https://www.zdnet.com/article/new-apple-macos-big-sur-feature-to-hamper-adware-operations/

Sodinokibi Ransomware Operators hit electrical energy company Light S.A.

Brazilian-based electrical energy company Light S.A. was allegedlly hit by Sodinokibi ransomware (aka REvil). Light S.A. confirmed the intrusion and it stated that the hackers have invaded the system and sent a virus that encrypts all Windows system files. Researchers at AppGate have analyzed a sample of the malware allegedly employed in the attack and were able to decrypt the configuration and access data about the ransomware, including the actor/campaign ID, and the URL provided to the victims to get instructions on how to pay the ransom. Threat actors are demanding a ransom of 106,870.19 XMR (Monero) by June 19, and if the time runs out, the operators are demanding an amount that is doubled (215882.8 XMR) approximately $14 million. The payment page is hosted on the TOR network that includes information about the attackers.

See the full report here: https://securityaffairs.co/wordpress/?p=105477

US Cyber Command urges F5 customers to patch critical BIG-IP flaw - BleepingComputer

F5 Networks has patched a critical remote code execution vulnerability in undisclosed pages of Traffic Management User Interface (TMUI) of the BIG-IP application delivery controller (ADC). One of the vulnerabilities, CVE-2020-5902, allows a remote attacker with access to the BIG-IP configuration utility could, without authorization, perform remote code execution. Another vulnerability, CVE-2020-5903 found in the BIG-IP configuration interface, can be used to fully compromise the BIG-IP system through remote JavaScript code execution if the currently logged-in user is an administrator. The vendor has released patches for the vulnerabilities and has urged the F5 customers to apply the patch immediately.

See the full report here: https://www.bleepingcomputer.com/news/security/us-cyber-command-urges-f5-customers-to-patch-critical-big-ip-flaw/

Try2Cry ransomware tries to worm its way to other Windows systems - BleepingComputer

A new ransomware known as Try2Cry is trying to worm its way onto other Windows computers by infecting USB flash drives and using Windows shortcuts (LNK files) posing as the targets' files to lure them into infecting themselves. Try2Cry is a .NET ransomware and a variant of the open-source Stupid ransomware family. After infecting a device, the ransomware encrypts .doc, .ppt, .jpg, .xls, .pdf, .docx, .pptx, .xls, and .xlsx files, appending a .Try2Cry extension to all encrypted files. The victims' files are encrypted using the Rijndael symmetric key encryption algorithm and a hard coded encryption key. Try2Cry ransomware is decryptable like the other Stupid ransomware variants as they are commonly known to be created by less skilled malware developers.

See the full report here: https://www.bleepingcomputer.com/news/security/try2cry-ransomware-tries-to-worm-its-way-to-other-windows-systems/

Fort Worth Bike Share hacked, users’ credit card info and names possibly compromised - Fort Worth Star-Telegram

BCycle, the corporation that operates Fort Worth’s bicycle-sharing service was hacked, and some users' credit card information may have been stolen. BCycle found malware on its website that allowed a hacker to see personal information between Jan. 24 and April 26. The company identified the affected users and informed them about the attack. The hack only impacts those who signed up for a membership pass through the website. The hacked information may include users’ names, credit card numbers, and addresses. BCycle has stated that it is not aware of any unauthorized transactions that resulted from the hack.

See the full report here: https://www.star-telegram.com/news/local/fort-worth/article243963067.html

Companies start reporting ransomware attacks as data breaches - BleepingComputer

Almost all ransomware operations, including Maze, REvil, Netwalker, DoppelPaymer, CLOP, RagnarLocker, Nephilim, Ako, and others have adopted a tactic to steal unencrypted files before encrypting a breached network. The threat actors then use these stolen files as leverage by threatening to leak or sell the data if a ransom is not paid. Hence, Corporate victims have started to issue data breach notifications when affected by a ransomware attack and additionally offer free credit monitoring and identity theft protection to affected employees and clients so that they can be alerted if their data is used publicly or for fraud.

See the full report here: https://www.bleepingcomputer.com/news/security/companies-start-reporting-ransomware-attacks-as-data-breaches/

Beware Of Fake TikTok Pro App; It Could Be Spyware Or Malware - Gizbot

Cybercriminals are pushing spyware dubbed as TikTok Pro that supposedly offers videos and also allows users to create new content similar to TikTok. A message to download the app along with its URL is being forwarded on various messaging apps. Just by clicking on the link, users could damage their smartphone and could permanently lose some or even all the data stored on your device. Android users are most vulnerable to this scam, especially if third-party app installation is enabled or if the smartphone has root access. There is no official app from TikTok called TikTok Pro and users are recommended to stay vigilant of such scams.

See the full report here: https://www.gizbot.com/apps/news/beware-of-fake-tiktok-pro-app-it-could-be-spyware-or-malware-068670.html

Cooke County in Texas apparently hit by gang using REvil ransomware - iTWire

Attackers claim to have hit the website of Cooke County in Texas using the REvil ransomware and stolen files and from their network and devices. To support their claims, the threat actors have posted screenshots of what they allege are documents and data from the county's police department on the dark web. The attackers have threatened to start releasing the data in a few days if their ransom demands are not met. Cooke County is yet to respond to the incident.

See the full report here: https://www.itwire.com/security/cooke-county-in-texas-apparently-hit-by-gang-using-revil-ransomware.html

Avaddon ransomware shows that Excel 4.0 macros are still effective - BleepingComputer

Microsoft has warned about a file-encrypting malware, Avaddon ransomware, focused on specific targets mainly in Italy, sending out emails with documents laced with malicious Excel 4.0 macros. Excel 4.0 macro (XML) is still compatible with modern software where VBA code is used instead. When run, the macro downloads an Avaddon ransomware sample directly, without an intermediary downloader, Microsoft notes. Excel 4.0 uses XML-based macros that store functions in BIFF (Binary Interchange File Format) records. This makes them more difficult to analyze compared to VBA macros that have dedicated streams and that are being used since Excel 5.0.

See the full report here: https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shows-that-excel-40-macros-are-still-effective/

New Behave! extension warns of website port scans, local attacks - BleepingComputer

Researchers have developed a new browser extension called Behave!, that warns users if a web site is using scripts to perform scans or attacks on local and private IP addresses on users' network. When browsing the web, scripts embedded on web pages can be used to port scan a visitor's computer for open TCP ports and initiate attacks on other devices connected to the network. Malicious actors can also use JavaScript embedded on web sites to perform DNS Rebinding attacks. These attacks are commonly used against routers, IoT devices, and even other internal computers known to run vulnerable software.

See the full report here: https://www.bleepingcomputer.com/news/security/new-behave-extension-warns-of-website-port-scans-local-attacks/

CISA warns organizations of cyberattacks from the Tor network

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have warned the organizations about the cyber-attacks from the Tor network. Threat actors are using the Tor network to hide the source of attacks and malicious activities including, system compromise, data exfiltration, denial of service (DoS) attacks, and reconnaissance. CISA recommends enterprises to adopt necessary security measures to block and monitor Tor network traffic, to identify attacks in an early stage.

See the full report here: https://securityaffairs.co/wordpress/105537/hacking/cisa-cyberattacks-from-tor-network.html

Cisco Talos discloses technicals details of Chrome, Firefox flaws

Researchers recently disclosed the technical details of the patched security flaws tracked as CVE-2020-6463 and CVE-2020-12418 affecting Chrome and Firefox web browsers. CVE-2020-6463 is a memory corruption vulnerability that affects PDFium, an open-source PDF library used by Chrome and other applications, and on the other hand, CVE-2020-12418 is an information disclosure vulnerability that is related to the URL mPath functionality of Mozilla Firefox Nightly Version 78.0a1 x64 and Firefox Release Version 76.0.2 x64. Both vulnerabilities have been patched and users are advised to update to the latest fixed versions of the Chrome and Firefox web browsers.

See the full report here: https://securityaffairs.co/wordpress/105547/security/talos-chrome-firefox-flaws.html

.NET Core vulnerability lets attackers evade malware detection - BleepingComputer

A vulnerability caused by a Path Traversal bug in Microsoft’s .NET Core library allows malicious garbage collection DLLs to be loaded by users with low privileges while evading detection by security software. The flaw impacts the latest stable release (3.1.x versions) of .NET Core. To exploit this bug, the attacker needs to have at least some level of access to the system to set environment variables. Because the exploitation of this flaw requires the attackers to have the ability to set environment variables on the compromised system, Microsoft does not consider this a security vulnerability. Hence, a fix is not currently available and could let attackers execute malicious code on a system without being readily detected by antivirus and EDR products.

See the full report here: https://www.bleepingcomputer.com/news/security/net-core-vulnerability-lets-attackers-evade-malware-detection/

TrickBot malware now checks screen resolution to evade analysis - BleepingComputer

Security researchers have discovered a new sample of the TrickBot Trojan that checks an infected computer's screen resolution to determine if it's a virtual machine. If the computer's screen resolution is 800x600 or 1024x768, TrickBot will terminate. TrickBot is checking for these particular resolutions because of how the researchers commonly configure their malware analysis virtual machines. Knowing this, the TrickBot developers are using these screen resolution checks as another anti-VM check.

See the full report here: https://www.bleepingcomputer.com/news/security/trickbot-malware-now-checks-screen-resolution-to-evade-analysis/

PoC exploits released for F5 BIG-IP vulnerabilities, patch now! - BleepingComputer

Security researchers have started publicly posting proof-of-concept (PoC) exploits for the recently patched F5 BIG-IP vulnerability (CVE-2020-5902) to show how easy it is to exploit the vulnerable devices. This vulnerability could allow a remote attacker to access the Traffic Management User Interface (TMUI) of the BIG-IP application delivery controller (ADC) without authentication and perform remote code execution. Successful exploitation of a BIG-IP device would allow an attacker to gain full access to the system, export user credentials, and potentially traverse the device's internal network. Organizations using F5 BIG-IP devices on their network are urged to patch their devices as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/poc-exploits-released-for-f5-big-ip-vulnerabilities-patch-now/

Android Users Hit with ‘Undeletable’ Adware

Kaspersky researchers have found that 14.8 percent of Android users who were targeted with mobile malware or adware last year were left with undeletable files. The malware ranges from trojans that can install and run apps without the user’s knowledge, to less threatening, advertising applications. Among the most common types of malware found installed in the system partition of Android smartphones are two older threats, the Lezok and Triada trojans. Examining victims’ system apps has revealed a wide range of threats, including the Agent trojan, Sivu trojan, Plague adware app, Necro.d trojan, Penguin, Facmod, Guerrilla, Virtualinst, Secretad, and many more. Researchers have also found that most devices harbor pre-installed default applications that are also undeletable.

See the full report here: https://threatpost.com/android-users-undeletable-adware/157189/

EDP energy giant confirms Ragnar Locker ransomware attack - BleepingComputer

EDP Renewables North America (EDPR NA) has confirmed that it fell victim to a Ragnar Locker ransomware attack which affected its parent corporation's systems, the Portuguese multinational energy giant Energias de Portugal (EDP). According to the company's breach notification, on April 13, 2020, EDPR NA’s parent corporation experienced a ransomware attack on its information systems and on May 8, 2020, it was discovered that unauthorized parties accessed some information stored on the company's servers. Investigations have revealed that the attackers were not able to access any personal information. However, the organization has notified the potentially impacted customers as their personal information, including name, and Social Security numbers were stored in EDPR NA's information systems.

See the full report here: https://www.bleepingcomputer.com/news/security/edp-energy-giant-confirms-ragnar-locker-ransomware-attack/

Ransomware attack on insurance MSP Xchanging affects clients - BleepingComputer

DXC Technology has announced that a ransomware attack has been detected on the systems of its subsidiary, Xchanging. Xchanging is a managed service provider for businesses in the insurance industry. The company reported the incident on July 5, assuring that it did not spread outside the Xchanging network. Currently, the investigation has not revealed any indication of data being affected. The company also disclosed that an undisclosed number of customers were impacted by the cyberattack, denying access to their operating environment. Efforts to restore services to customers are ongoing. There is no information about the family of the file-encrypting malware used in the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-on-insurance-msp-xchanging-affects-clients/

Lazarus Group Adds Magecart to the Mix

North Korea-based APT, Lazarus Group, has added digital payment-card skimming to their collection, using Magecart code. According to the researchers, Lazarus is using spearphishing emails as its initial infection vector to compromise the sites, in an effort ultimately aimed at obtaining the passwords of retail staff. The hackers could then use that access to inject the skimming script, which captures information that shoppers enter into e-commerce check-out pages. The data is then sent to hacker-controlled servers via a global exfiltration network. Lazarus members are targeting online payments made by American and European shoppers.

See the full report here: https://threatpost.com/lazarus-group-adds-magecart/157167/

Credit-Card Skimmer Seeks Websites Running Microsoft's ASP.NET

In a new campaign, a credit-card skimmer is exclusively targeting websites hosted on Microsoft IIS servers and running ASP.NET, the company's web framework for developing web applications and services. Researchers have found more than a dozen websites compromised with malicious code injected into one of their existing JavaScript libraries. The campaign likely started in April 2020 and has affected a range of victims, including sports organizations, health and community associations, and a credit union. All victim websites were running ASP.NET version 4.0.30319, which, according to the researchers, is no longer officially supported and contains multiple flaws.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/credit-card-skimmer-seeks-websites-running-microsofts-aspnet/d/d-id/1338279

Mozilla suspends Firefox Send service while it addresses malware abuse

Mozilla has temporarily suspended the Firefox Send file-sharing service as the organization investigates reports of abuse from malware operators and while it adds a "Report abuse" button. Launched in March 2019, the service provides secure and private file-hosting and file-sharing capabilities for Firefox users. Despite its name, the service is accessible for anyone accessing the send.firefox.com web portal. All files uploaded and shared through Firefox Send are stored in an encrypted format, and users can configure the amount of time the file is saved on the server and the number of downloads before the file expires. Firefox Send has seen broader adoption in the malware community, where malware authors upload payloads on Firefox Send and the file is stored in an encrypted format. The hackers then share the links inside emails which they send to their targets. FIN7, REVil (Sodinokibi), Ursnif (Dreambot), and Zloader are just some of the few malware gangs and strains that have been seen hosting payloads on Firefox Send. The company will relaunch the product after adding an abuse reporting mechanism to augment the existing Feedback form, and it will require all users wishing to share content using Firefox Send to sign in with a Firefox Account.

See the full report here: https://www.zdnet.com/article/mozilla-suspends-firefox-send-service-while-it-addresses-malware-abuse/

Microsoft seizes six domains used in COVID-19 phishing operations

Microsoft has obtained a court order to seize control of six domains that were used in phishing operations against Office 365 customers, including in campaigns that leveraged COVID-19 lures. A phishing group has been targeting the company's customers since December 2019. The group operates by sending spoofed emails to companies that hosted email servers and enterprise infrastructure on Microsoft's Office 365 cloud service. The hackers touted an Office document, and when victims tried to open the file, they were redirected to install a malicious third-party Office 365 app. The app, when installed, grants the hackers with full access to the victim's Office 365 account, its settings, the user's files, the content of their emails, contact lists, notes, and others.

See the full report here: https://www.zdnet.com/article/microsoft-seizes-six-domains-used-in-covid-19-phishing-operations/

First-Ever Russian BEC Gang, Cosmic Lynx, Uncovered

Security researchers have discovered the first-ever reported Russian business email compromise (BEC) cybercriminal group dubbed 'Cosmic Lynx' that has been associated with more than 200 BEC campaigns targeting senior-level executives in 46 countries since last July. The threat group uses extremely well-written emails, targets victims without DMARC policies, and uses a fake “merger-and-acquisition” scenario to lure the victims and steal large sums of money. The pretext in almost all attacks observed is that the victim’s company is preparing to close an acquisition deal with an Asian company. Cosmic Lynx purports to be the Asian company’s CEO and asks the target employee to work with “external legal counsel” to assist with the payments for the fake acquisition. Finally, the target employee is asked to send one or more payments to mule accounts controlled by the group, as part of the acquisition. It then moves the stolen funds through money mule accounts in Hong Kong. Other accounts are also located in Hungary, Portugal, and Romania.

See the full report here: https://threatpost.com/russian-bec-gang-cosmic-lynx-uncovered/157166/

DOJ indict Fxmsp hacker for selling access to hacked orgs, AV firms - BleepingComputer

The DOJ is charging a citizen of Kazakhstan named Andrey Turchin, also known as "Fxmsp," with conspiracy to commit computer hacking, two counts of computer fraud and abuse (hacking), conspiracy to commit wire fraud, and access device fraud. According to the indictment, Turchin gained access to private networks through phishing attacks and brute-forcing the passwords of exposed remote desktop servers. Once a network was breached, he allegedly deployed password-stealing Trojans and remote access trojans (RATs) to harvest credentials and gain persistence in the system. Under the alias 'Fxmsp', he sold access to the intruded networks on hacker forums and dark web marketplaces for prices typically ranging between $1,000 to tens of thousands. The hacker has intruded into and sold access to over three hundred organizations worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/doj-indict-fxmsp-hacker-for-selling-access-to-hacked-orgs-av-firms/

More pre-installed malware has been found in budget US smartphones

A pre-installed malware has been discovered on another budget handset connected to Assurance Wireless by Virgin Mobile, according to a research report from Malwarebytes, The affected model is an American Network Solutions (ANS) UL40 running Android OS 7.1.1. The device comes infected with a compromised Settings app and the Wireless Update app. Settings app can download malicious apps from a third-party app store; removing it would leave the device unusable. WirelessUpdate is categized as a Potentially Unwanted Program (PUP) and instructions to uninstall this app are available. The company is yet to resolve the issue.

See the full report here: https://www.zdnet.com/article/more-pre-installed-malware-has-been-found-in-budget-us-smartphones/

Palo Alto Networks fixes another severe flaw in PAN-OS devices - BleepingComputer

Palo Alto Networks addressed another severe vulnerability found in the PAN-OS GlobalProtect portal and affecting unpatched PAN next-generation firewalls. Tracked as CVE-2020-2034, the OS command injection vulnerability allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges on unpatched devices. It can be exploited by threat actors with network access to vulnerable servers as part of high complexity attacks that don't require user interaction. This issue is applicable only where the GlobalProtect portal is enabled and does not impact Prisma Access services. Affected users are advised to update to the latest version of PAN-OS.

See the full report here: https://www.bleepingcomputer.com/news/security/palo-alto-networks-fixes-another-severe-flaw-in-pan-os-devices/

Citrix fixes 11 flaws in ADC, Gateway, and SD-WAN WANOP appliances - BleepingComputer

Citrix has released patches for a set of 11 vulnerabilities that affects Citrix ADC, Citrix Gateway, and Citrix SD-WAN WANOP, appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO, networking products. According to Citrix, these vulnerabilities are not related to CVE-2019-19781 remote code execution flaws and do not affect cloud versions of Citrix appliances. If successfully exploited, these vulnerabilities could lead to various security issues depending on the targeted area. A security advisory with detailed information on these vulnerabilities is available on the Citrix website. Customers are urged to apply the latest updates as soon as possible to defend against potential attacks designed to exploit them.

See the full report here: https://www.bleepingcomputer.com/news/security/citrix-fixes-11-flaws-in-adc-gateway-and-sd-wan-wanop-appliances/

NVIDIA fixes code execution bug in GeForce Experience software

NVIDIA has addressed a vulnerability in the Windows NVIDIA GeForce Experience (GFE) software that could allow local attackers to execute arbitrary code, trigger a denial of service (DoS) state, or access privileged information on unpatched systems. The security flaw tracked as CVE‑2020‑5964 requires attackers to have local user access to the device and cannot be exploited remotely, it can still be abused with the help of malicious tools delivered to systems running vulnerable NVIDIA GFE versions. After successful exploitation, the attacker can gain access to sensitive information beyond the permissions initially granted by the compromised system or render them unusable by triggering a denial of service state. The security issue impacts Windows computers running versions of NVIDIA GeForce Experience before 3.20.4. Users are advised to update to NVIDIA GeForce Experience the latest software version.

See the full report here: https://www.bleepingcomputer.com/news/security/nvidia-fixes-code-execution-bug-in-geforce-experience-software/

Conti ransomware uses 32 simultaneous CPU threads for blazing-fast encryption

Security researchers at Carbon Black have spotted infections of a lesser-known ransomware strain called Conti in the wild. It incorporates several unique features. The first feature is that it uses a large number of concurrent threads, namely 32 that results in faster encryption compared to other malware families. The second feature is the fine-grained control over the ransomware's encryption targets via a command-line client. The ransomware can be configured to skip encrypting files on the local drives and encrypt data on networked SMB shares just by feeding the ransomware's binary a list of IP addresses via the command-line. The third and the most unique technique spotted is its abuse of Windows Restart Manager ( Windows component that unlocks files before performing an OS restart). Conti invokes this component to unlock and shut down app processes so it can encrypt their respective data. Currently, there is no way to recover files locked through the Conti ransomware.

See the full report here: https://www.zdnet.com/article/conti-ransomware-uses-32-simultaneous-cpu-threads-for-blazing-fast-encryption/

Malicious app in Google Play used to deliver Cerberus Banking Trojan

AVAST researchers have discovered a malicious code disguised as a currency converter named Calculadora de Moneda app in the Google Play store and was downloaded by more than 10000 times. The app was designed to deliver the Cerberus banking Trojan and targeted Android users in Spain. To avoid initial detection, the app hid its malicious intentions for the first few weeks while being available on Google Play. It was used as a dropper and was updated later to receive commands from a C2 server to download a Cerberus banker in the form of an APK. Once executed, the malware steals victims’ bank account credentials and bypass security measures, including two-factor authentication (2FA). Currently, the C2 server has disappeared and the currency converter app on Google Play no longer contains the Trojan malware. This is suspceted to be a tactic adopted by the attackers to avoid detection. Thus users are recommended to download applications from trusted app stores only.

See the full report here: https://securityaffairs.co/wordpress/105649/malware/cerberus-banking-trojan-google-play.html?utm_source=rss&utm_medium=rss&utm_campaign=cerberus-banking-trojan-google-play

Phishing alert: Hackers use fake TikTok Pro app to lure victims in India - Deccan Herald

The Indian government recently banned popular Chinese video sharing platform TikTok along with 58 other Chinese apps. TikTok reportedly had around 200 million users in India. Scammers are trying to use the TikTok ban as an opportunity to scam users with an app called TikTok Pro. Malicious messages are shared with users and Once the user clicks on the link, it takes to a shady website and an APK file gets installed on the phone with the original TikTok-like logo. The fake sinister TikTok app increases the risk of gaining access to sensitive information from the storage or track the user. Users are advised to download apps from official websites.

See the full report here: https://www.deccanherald.com/specials/phishing-alert-hackers-use-fake-tiktok-pro-app-to-lure-victims-in-india-858702.html