Threat Intelligence Bulletin: 07/17/2020 - 07/23/2020

Breach Disclosure: Wattpad

Wattpad, a popular website that allows members to publish stories on various topics, was recently involved in a breach of around 270,000,000 records for over $100,000. This breach has been rumored since July 7th of this year, and was rumored to be sold by Shiny Hunters, the group responsible for a number of high-profile, large breaches in recent months.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The records contained in this database consisted of user names, names, hashed passwords (mix of bcrypt and sha256 hashes), email addresses, and geographic location information. In a message from Wattpad, they claim that no financial information, phone numbers, stories or private messages were accessed during the incident that allowed attackers access to the database.

While the database was initially being listed for ten bitcoins (~$100,000), this breach has appeared on RaidForums for free and has been redistributed in multiple threads since the original posting.

Figure 1: Breach listing on RaidForums

Breaking News: 2020-07-17 - 2020-07-23

New Android malware steals your dating and social accounts

Security researchers from ThreatFabric have discovered a new Android banking trojan dubbed BlackRock that steals credentials and credit card information from a list of 337 apps many of them used for non-financial purposes with a focus on social, communication, networking, and dating platforms. The malware is derived from the leaked source code of the Xerxes banking malware, a known strain of the LokiBot Android trojan. BlackRock camouflages itself as Google Update, requests Accessibility Service privileges and it hides its icon when launched by the victims. Once the request is granted, BlackRock starts by granting itself additional permissions that are required for the bot to fully function without having to interact with the victim. The operators then control the malware remotely to launch overlay attacks and issue commands including logging keystrokes, spamming the victims' contact lists with text messages, setting the malware as the default SMS manager, pushing system notifications to the C2 server, and blocking victims from launching or using antivirus or system cleaning software. The malware also makes use of Android work profiles to control the compromised device by creating its own managed profile with admin rights.

See the full report here: https://www.bleepingcomputer.com/news/security/new-android-malware-steals-your-dating-and-social-accounts/

Amazon-Themed Phishing Campaigns Swim Past Security Checks - Threatpost

In the era of COVID-19, Amazon has become a staple of people’s lives. Cybercriminals are leveraging this opportunity to use delivery messages as a lure to conduct phishing campaigns. Researchers at Armorblox recently spotted a pair of campaigns targeting Amazon. In the first campaign, an email is sent to a customer from a compromised third-party vendor email account where the recipient is urged to update the payment details to avoid order cancellation. The mail contains a link to “update Amazon billing information.” Clicking on the link, the victim was redirected to a full-fledged Amazon lookalike site with a phishing flow that aimed to steal login credentials, billing address information, and credit card details. In the second campaign, attackers sent emails purporting to communicate about an Amazon delivery order. The email included a phone number for the ‘Fraud Protection Team’ to call in case the order was fraudulent. On dialing, it is connected to a person, pretending to be from the Amazon fraud protection team. They ask for order number, name, credit-card details before disconnecting the call and blocking the number.

See the full report here: https://threatpost.com/amazon-phishing-campaigns-security-checks/157495/

Orange confirms ransomware attack exposing business customers' data - BleepingComputer

On July 15th, 2020, the operators of Nefilim Ransomware added Orange to their data leak site and stated that they breached the company through their "Orange Business Solutions" division. Orange is a French telecommunications company that offers consumer communication services and business services to the enterprise. The breach occurred on the night of Saturday, July 4, to Sunday, July 5, 2020. The hackers gained access to twenty Orange Pro/SME customers' data. A 339MB archive file, posted on the site, contained emails, airplane schematics, and files from ATR Aircraft, a French aircraft manufacturer. The company has confirmed that they suffered a ransomware attack and informed all the affected customers.

See the full report here: https://www.bleepingcomputer.com/news/security/orange-confirms-ransomware-attack-exposing-business-customers-data/

US actor casting company leaked private data of over 260,000 individuals

MyCastingFile[.]com, New Orleans-based online casting agency that recruits US talent has exposed the data of roughly 260,000 individuals online. Security researchers from Safety Detectives discovered an open Elasticsearch server belonging to MyCastingFile, hosted by Google Cloud in the United States. The database was not secured via any form of authentication and in total, close to 10 million records were exposed. The database was 1GB in size and upon investigation, it was found that over 260,000 users of the website had their profiles leaked, including aspiring actors and potential members of staff. The leaked Personally identifiable information (PII) includes names, physical addresses, email addresses, phone numbers, work histories, dates of birth, height and weight, ethnicity, photographs of faces and bodies, and physical features of interest to potential employers such as hair color and length. Besides, the records included vehicle ownership information, such as model, color, and year of manufacture. However, the researchers reported the issue to MyCastingFile and following which the Elasticsearch server was secured immediately.

See the full report here: https://www.zdnet.com/article/us-actor-casting-company-leaked-private-data-of-over-260000-individuals/

Mac users trying to trade cryptocurrencies targeted by Gmera Trojan operators

Apple macOS users are being targeted in a fresh campaign aiming to pilfer cryptocurrency from their wallets. Researchers at ESET, discovered websites distributing malicious cryptocurrency trading applications for Mac. The Trojanized applications are being offered online as versions of legitimate trading software such as those developed by Kattana, an organization that has created a desktop terminal app for crypto traders. The malware authors wrapped the legitimate application to include Gmera malware and rebranded the Kattana trading application with new names and copied its original website, tracked as Cointrazer, Cupatrade, Licatrade, and Trezarus. The malware is used to steal information such as browser cookies, cryptocurrency wallets and screen captures and its operations are limited on the most recent version macOS. Mac users doing online trading are recommended to download apps from original & trusted sources.

See the full report here: https://www.zdnet.com/article/mac-users-trying-to-trade-cryptocurrencies-targeted-by-trojan-operators/

Diebold Nixdorf warns of a new class of ATM 'black box' attacks across Europe

ATM maker Diebold Nixdorf is warning banks of a new type of ATM "black box" attack that was recently spotted used across Europe. A black box attack is when an intruder unfastens an ATM outer case to access its ports or cuts a hole in the casing for direct access to its internal wiring or other hidden connectors. The new attacks have been observed used only against ProCash 2050xe ATM terminals. Some of the successful attacks show a new adapted Modus Operandi on how the attack is performed. Although the fraudster is still connecting an external device contains parts of the software stack of the attacked ATM. The company is analyzing the attacks and recommends customers to verify the provided countermeasures.

See the full report here: https://www.zdnet.com/article/diebold-nixdorf-warns-of-a-new-class-of-atm-black-box-attacks-across-europe/

A New Flaw In Zoom Could Have Let Fraudsters Mimic Organisations

Researchers at cybersecurity firm CheckPoint disclosed details of a minor but easy-to-exploit flaw they reported in Zoom, widely used video conferencing software. This flaw could have allowed attackers to mimic an organization, tricking its employees or business partners into revealing personal or other confidential information using social engineering tricks. The vulnerability resides in Zoom's customizable URL feature dubbed Vanity URL, aiming to let companies create a custom URL on its subdomain and branded landing page. There are several ways to enter a meeting containing a sub-domain, including using a direct sub-domain link containing the meeting ID or using the organization's customized sub-domain web UI. The impact can lead to a successful phishing attempt to steal credentials and sensitive information and carry out other fraud actions. The company is working on the fix.

See the full report here: https://thehackernews.com/2020/07/zoom-vanity-url-vulnerability.html

Cloud provider stopped ransomware attack but had to pay ransom demand anyway

During a press release, Blackbaud, a provider of software and cloud hosting solutions has confirmed that it stopped a ransomware attack from encrypting files earlier this year but still had to pay a ransom demand anyway after hackers stole data from the company's network and threatened to publish it online. The breach took place in May 2020, where hackers breached its network and attempted to install ransomware in order to lock the company's customers out of their data and servers. After the discovery of the attack, the Cyber Security team, along with external forensics experts, were successfully able to prevent the cybercriminal from blocking the system access and fully encrypting files. However, the hackers managed to steal a subset of data from its "self-hosted environment," where customers save their files.

See the full report here: https://www.zdnet.com/article/cloud-provider-stopped-ransomware-attack-but-had-to-pay-ransom-demand-anyway/

Emotet spam trojan surges back to life after 5 months of silence - BleepingComputer

After months of inactivity, the notorious Emotet spamming trojan has resurfaced with a massive campaign of malicious emails targeting users worldwide. The recent spam campaign used reply-chain, shipping, payment, and invoice spam that delivers malicious Word documents spreadsheets using new URLs that are hacked WordPress sites. One of the Emotet spam emails contained a subject 'Jobs GO', with a malicious Word document. The mail stated that the document cannot be opened properly as it was created on iOS and to view and edit document users should click Enable Edition and then click Enable Content. After enabling macros in the document, a PowerShell command is executed that downloaded and executed the Emotet executable from hacked WordPress sites. Once the malware is running, it will deploy further malicious modules in order to steal a victim's mail, spread to other computers, or use the infected computer to send spam.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-spam-trojan-surges-back-to-life-after-5-months-of-silence/

Magento adds 2FA to protect against card skimming attacks - BleepingComputer

Adobe has added two-factor authentication (2FA) throughout the Magento platform in response to the widespread number of attacks where skimmer scripts are deployed on hacked e-commerce sites to steal customers' credit cards. According to Adobe, the 2FA security will protect from malicious users attempting to perform unauthorized logins in Magento.com accounts, Cloud Admin, and the Magento Admin. With 2FA, Magento admins will have an additional layer of authentication to decrease the attack surface by preventing threat actors from gaining access to the site through the admin portal using a compromised account. While 2FA on the Magento Admin is optionally available on all supported versions of Magento Commerce, beginning with the release of 2.4, 2FA will be enabled by default for the Magento Admin and cannot be disabled.

See the full report here: https://www.bleepingcomputer.com/news/security/magento-adds-2fa-to-protect-against-card-skimming-attacks/

Discord, Postmates, and other popular apps and websites were down for some users on Friday due to a Cloudflare outage

Cloudflare suffered an outage on Friday that disrupted the functioning of many sites, including the gaming chat app Discord and food delivery platform Postmates. The outage appears to have been caused by problems that traced back to a router in Atlanta. The company has fixed the issue and is monitoring the results to know the root cause of the outage.

See the full report here: https://www.businessinsider.com/cloudflare-outage-google-dns-discord-postmates-apps-down-2020-7

Microsoft releases open-source Linux version of Procmon tool - BleepingComputer

Microsoft has released a Linux version of the popular Procmon utility that Linux users can utilize to monitor running processes. Procmon is a Windows utility that monitors the system calls, Registry access, and file activity for processes running in the operating system, allowing users to diagnose problems with programs crashing, heavy resource utilization, and even potential malware infections. Microsoft has also provided instructions on building Procmon on its GitHub page.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-open-source-linux-version-of-procmon-tool/

Seven 'no log' VPN providers accused of leaking – yup, you guessed it – 1.2TB of user logs onto the internet

A security researcher has found more than a terabyte of user logs that were spotted on a string of "zero logging" VPN providers' servers, unprotected, and facing the public internet. Reportedly, the exposed data included clear-text passwords, personal information, and lists of websites visited. Each of these VPN providers claimed that their services are 'no-log' VPNs, which means that they don’t record any user activity on their respective applications. However, multiple instances of internet activity logs on their shared server were found. This was in addition to the personally identifiable information, which included email addresses, clear text passwords, IP addresses, home addresses, phone models, device ID, and other technical details.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/07/17/ufo_vpn_database/

New phishing campaign abuses a trio of enterprise cloud services - BleepingComputer

In a new phishing campaign, attackers are using a trio of enterprise cloud services, Microsoft Azure, Microsoft Dynamics, and IBM Cloud, as part of an attempt to steal your login credentials. The phishing email imitates a “quarantined mail” notification from a help desk named “servicedesk[.]com” that is frequently sent out in workplaces by email security products and spam filters, asking the user to “release” messages stuck in the queue. The email is embedded with “RELEASE MESSAGES” or “CLEAN-UP CLOUD” buttons that, when clicked on, brings the user to a legitimate Microsoft Dynamics 365 URL. This URL then redirects the user to an IBM Cloud domain, cf.appdomain.cloud used for IBM’s Cloud Foundry deployments, to host the phishing landing page. Entering a password will redirect the user to another fake page confirming the settings update host on Microsoft Azures hosting domain, windows.net. This malicious page eventually redirects the user to the website associated with their email address domain.

See the full report here: https://www.bleepingcomputer.com/news/security/new-phishing-campaign-abuses-a-trio-of-enterprise-cloud-services/

Twitter says hackers downloaded the data of eight users in Wednesday's hack

Twitter has provided new updates following the investigation into its Wednesday security incident where the hackers compromised accounts for public figures to tweet a cryptocurrency scam. Twitter said hackers got through their two-factor protections and accessed the Twitter backend and allowed Twitter's own internal tech support tools to interact with accounts. Hackers interacted with 130 accounts, according to Twitter. For 45 accounts, hackers initiated a password reset, logged into the account, and sent new tweets to promote their cryptocurrency scam. Twitter said it believes hackers also tried to sell access to some hijacked Twitter accounts, due to highly-coveted usernames. For eight accounts, hackers downloaded account data through the "Your Twitter Data" feature. Twitter said it had no reason to believe the hackers had access to cleartext passwords and will not be resetting user passwords going forward. However, attackers did view information such as email addresses and phone numbers for the targeted accounts.

See the full report here: https://www.zdnet.com/article/twitter-says-hackers-downloaded-the-data-of-eight-users-in-wednesdays-hack/

Tedrade banking malware families target users worldwide

Cybersecurity researchers from Kaspersky Lab have detailed four different families of Brazilian banking trojans that have targeted financial institutions in Brazil, Latin America, and Europe. Tracked as Tedrade, the four malware families, Guildma, Javali, Melcoz, and Grandoreiro, are believed to be the result of a Brazilian banking group/operation that is evolving its capabilities targeting banking users abroad. The Brazilian cybercrime underground is recognized as the most focused on the development and commercialization of banking trojans. Both Guildma and Javali employ a multi-stage attack chain and were distributed using phishing messages using compressed email attachments (e.g., .VBS, .LNK) or an HTML file which executes JavaScript for downloading a malicious file. Melcoz is an open-source RAT that is capable to steal passwords from browsers, and information from clipboard and Bitcoin wallets by replacing the original wallet details with the one under the control of the attacker. Grandoreiro is hosted on Google Sites pages and spreads via compromised websites and Google Ads and is also deliver it via spear-phishing messages. It uses the Domain Generation Algorithm (DGA) for hiding the C2 address used during the attack.

See the full report here: https://securityaffairs.co/wordpress/106126/malware/tetrade-brazilian-banking-troja.html?utm_source=rss&utm_medium=rss&utm_campaign=tetrade-brazilian-banking-troja

Microsoft Edge 84 introduces Storage Access API to improve privacy - BleepingComputer

To help improve privacy and block unwanted access by unknown or untrusted parties, Microsoft has added new Storage Access API settings in its Edge 84, which is now available for the desktop users and comes with support for PDF reader improvements, and more. With this API, Microsoft Edge enables access to first-party storage in a third-party context when a user provides a "direct intent" to allow storage. If users don't provide access to their storage, it would be blocked by Microsoft Edge's default or current configuration.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-84-introduces-storage-access-api-to-improve-privacy/

Hackers Hack Telecom Argentina, Demand USD 7.5 Million In Monero - Cryptonews

Argentina's largest telecommunications company, Telecom S.A., has suffered a ransomware attack. According to sources, the attack has not affected users on the internet and telephone services provided by Telecom Argentina. However, the company has reportedly lost access to Office365 and OneDrive files. Other affected internal systems include corporate VPN, Citrix, Siebel, Genesys, the Customer and Field Service virtual machines, and internal users’ PCs. The hackers are demanding a ransom of USD 7.5m in privacy coin monero (XMR) and threaten to increase the payable amount if the company fails to meet their demands. Telecom Argentina S.A. is yet to issue an official statement on the situation.

See the full report here: https://cryptonews.com/news/hackers-hack-telecom-argentina-demand-usd-7-5-million-in-mon-7161.htm

Critical SIGred Windows DNS bug gets micropatch after PoCs released - BleepingComputer

The critical remote code execution security vulnerability in Windows DNS known as SIGRed has received a micropatch for servers without an Extended Security Updates (ESU) license. The vulnerability is tracked as CVE-2020-1350 and can be exploited in a wormable fashion, allowing an adversary to expand their attack to all affected systems on the network without user interaction and the 0patch platform from Acros Security has been updated this week with corrective instructions to protect against SIGRed. The fix is delivered in memory and no system restart is necessary. The micropatch is available for clients with a 0Patch PRO subscription that runs Windows Server 2008 R2.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-sigred-windows-dns-bug-gets-micropatch-after-pocs-released/

Microsoft investigating Windows 10 2004 'No Internet' bug, how to fix

Windows 10 users are reporting 'no internet' access in the Network Connectivity Status Indicator (NCSI) on Windows 10 2004 devices even though their devices are connected to the Internet. Customers reported experiencing this issue after upgrading to 2004, and with system reboots, the router resets, and driver updates are not fixing the problem. The issue seems to be connected to a bug that prevents NCSI to correctly determine if an impacted Windows 10 is connected to the Internet. In Windows 10, NCSI periodically connects to the msftconnecttest[.]com/connecttest.txt, the site to check if the returned content is the string 'Microsoft Connect Test'. If the returned string is the one it expects, NCSI will tell the OS to display a "Connected," or display a "No Internet access" message if it isn't. The company is currently investigating this known Windows 10 2004 bug, with a fix to be delivered to affected devices with a future cumulative update. Users are recommended to make sure NCSI properly detects internet access is to enable NCSI Active Probing using the Registry Editor according to multiple user reports.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-investigating-windows-10-2004-no-internet-bug-how-to-fix/

Windows 10 Store 'wsreset' tool lets attackers bypass antivirus

Security researcher Daniel Gebert has discovered a technique that exploits Windows 10 Microsoft Store called 'wsreset.exe' which can be abused to delete arbitrary files. Wsreset.exe is a legitimate troubleshooting tool that lets users diagnose problems with the Windows Store and reset its cache. The tool runs with elevated privileges allowing attackers to delete files even if they would not normally have the privileges. The researcher demonstrated how this behavior could be abused to bypass antivirus protection on a host without being detected. This privilege escalation vulnerability can also be abused for other purposes. Workarounds are available in Microsoft Community forums.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-10-store-wsreset-tool-lets-attackers-bypass-antivirus/

Durham Radio Beats Back Ransomware Attack | FYIMusicNews - FYI Music News

Canadian radio broadcasting group, Durham Radio was hit with a Pysa ransomware attack that forced the stations off the air recently. According to an official, the ransomware attack came in as an attachment and cleaned the music libraries and ad spots stored on the company's hard-drives, station’s computers were not hacked during the incident. Durham’s technical team sorted things out and got them all back on air in a few hours and refused to pay the ransom. As a precaution, Durham has doubled up all of its information and secured it on a third-party cloud service.

See the full report here: https://www.fyimusicnews.ca/articles/2020/07/19/durham-radio-beats-back-ransomware-attack

Lorien Health Services discloses ransomware attack affecting nearly 50,000

Netwalker ransomware operators have targeted Lorien Health Services in a ransomware attack and leaked the data belonging to them after the company refused to pay the ransom. The company said that the incident was detected on June 6 and contracted services of cybersecurity experts to start an investigation and determine the impact. Leaked information may have included employees' and residents’ names, Social Security numbers, dates of birth, addresses, and health diagnosis and treatment information, impacting around 47,754 individuals. Lorien has notified the potentially impacted individuals and has offered complimentary credit monitoring and identity protection services.

See the full report here: https://www.bleepingcomputer.com/news/security/lorien-health-services-discloses-ransomware-attack-affecting-nearly-50-000/

Emotet-TrickBot malware duo is back infecting Windows machines

The Emotet and TrickBot duo is once again targeting Windows computers in massive spam campaigns pretending to be payment reports, invoices, shipping information, and employment opportunities. These spam emails contain malicious documents that will install the Emotet trojan on the recipient's computer when opened and macros enabled. Once a user became infected with Emotet, the trojan would eventually download and install the TrickBot trojan on the infected computer. TrickBot can perform various malicious activities on an infected computer, such as attempting to spread laterally through a network, steal Active Directory Services databases, harvest login credentials and cookies from browsers, steal OpenSSH keys, RDP, VNC, Putty and banking credentials.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-trickbot-malware-duo-is-back-infecting-windows-machines/

Executives Targeted with Account Hack, Impersonations and Other Social Media Security Threats

ZeroFOX has observed a 95% increase in executive/VIP-related threat activity during the first half of 2020, totaling over 1.2M incidents for over 7,000 executives ZeroFOX protects. Following the latest slew of the takeover of executive, celebrity, and corporate accounts in a cryptocurrency scam, ZeroFOX explains that a crypto giveaway is a scam where people are enticed with a high payout of cryptocurrency if they invest a small amount of bitcoin into the target address, which is typically done by impersonators and coordinated behaviors from other accounts claiming that they received bitcoin. Once the money is sent, the scammers flee with the money and never payout for their entries. Early warning of attempted account takeovers or physical threats to executives, awareness of attack planning via dark web chatter, advertisement of breached data or stolen credentials, all provide real-time situational awareness based on indicators that allow organizations to take quick remediation actions.

See the full report here: https://www.zerofox.com/blog/executive-account-hack-rise/

Twilio: Someone broke into our unsecured AWS S3 silo, added 'non-malicious' code to our JavaScript SDK

Twilio has confirmed that miscreants broke into its unsecured cloud storage systems and modified the JavaScript SDK it offers to customers. An external third party was able to get into Twilio's Amazon Web Services S3 bucket, which was left unsecured, and modify the TaskRouter v1.20 SDK to include "non-malicious" code that appeared to track usage of the software. Investigations have revealed that no customer data was accessed by a bad actor. The company implemented measures within 12 hours to resolve the issue.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/07/21/twilio_sdk_code_injection/

Chinese APT group targets India and Hong Kong using new variant of MgBot malware

A Chinese state-sponsored actor is suspected to be behind a new campaign that targets India and Hong Kong using a new variant of MgBot malware. An archive file with an embedded document pretending to be from the government of India was used to drop a malicious template that loaded a variant of Cobalt Strike. Another template dropped a loader called MgBot, executing and injecting its final payload through the use of Application Management (AppMgmt) Service on Windows. The researchers also observed another archive file with an embedded document borrowing a statement about Hong Kong from UK’s prime minister Boris Johnson. This document used the same TTPs to drop and execute the same payload. Threat actors used various malicious templates to leverage the political tensions between the nations and drop malware variants like Cobalt Strike and Mgbot on the targeted systems.

See the full report here: https://malware.news/t/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/41816/1

7 VPN services left data of millions of users exposed online

Security experts at vpnMentor have discovered a group of seven free VPN (virtual private network) apps that left their server unsecured, exposing private user data online. The impacted VPN services are UFO VPN, FAST VPN, FREE VPN, SUPER VPN, Flash VPN, Secure VPN, and Rabbit VPN. The unsecured server contained Personally Identifiable Information (PII) data for potentially over 20 million Virtual Private Network users. Exposed data included the users’ email and home addresses, passwords in plain text, and IP addresses as well as logs of internet activity of the users. According to researchers, the VPNs exposed seem to have been developed by the same authors that share a common Elasticsearch server and have a single recipient for payments, Dreamfii HK Limited. The researchers disclosed their findings to the VPN providers and then contacted the Hong Kong Computer Emergency Response Team. Following which the server was secured.

See the full report here: https://securityaffairs.co/wordpress/106181/data-breach/7-vpn-data-leak.html?utm_source=rss&utm_medium=rss&utm_campaign=7-vpn-data-leak

Adobe Photoshop gets fixes for critical security vulnerabilities

Adobe has patched 12 critical vulnerabilities affecting Adobe Photoshop, Adobe Prelude, and Adobe Bridge. These flaws could allow attackers to gain information and execute arbitrary code on Windows devices. The arbitrary code execution vulnerabilities are all 'Out-of-bounds write' and 'Out-of-bounds read' bugs in Windows versions that could allow arbitrary code execution in the security context of the logged-in user. For users running as a standard Windows users, not an administrative account, the impact of these vulnerabilities is greatly restricted unless chained with another vulnerability that elevates privileges. However, Adobe users are highly recommended to download and install the latest versions of the affected software to protect their systems and businesses from potential cyber-attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-photoshop-gets-fixes-for-critical-security-vulnerabilities/

Experts warn of massive internet scans for SAP systems affected by RECON Vulnerability

Researchers from Bad Packets have warned that threat actors are scanning the Internet for SAP systems affected by the RECON vulnerability after a researcher released a proof-of-concept (PoC) exploit. Tracked as CVE-2020-6287, the vulnerability is caused by the lack of authentication in an SAP NetWeaver AS for Java web component. The flaw resides in the SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30 to 7.50. The PoC exploit for the RECON flaw cannot be used to create an admin account, but exploits the flaw vulnerabilities to check if an SAP server is vulnerable to attacks and to download any ZIP archive from the vulnerable server. However, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations to patch their internet-facing systems as soon as possible. If not possible, organizations could apply mitigations proposed by SAP to its customers.

See the full report here: https://securityaffairs.co/wordpress/106064/hacking/recon-vulnerability-internet-scans.html?utm_source=rss&utm_medium=rss&utm_campaign=recon-vulnerability-internet-scans

Microsoft Edge gets new features on desktop and mobile

Microsoft has announced new features for Microsoft Edge for Windows 10, such as automatic profile switching, adding notes to collections. The Android & iOS version gets feature to access, add, and organize Collections. Starting next month, Microsoft Edge is part of the FastTrack Ready Partner program. This gives people more options to deploy and configure the new Microsoft Edge in their organizations. Endpoint Data Loss Protection (DLP) is now available in public preview for Microsoft Edge. The tool mitigates data leakage and risks and also addresses regulation and privacy. Microsoft Edge now supports Automatic Profile Switching. These features automatically openwork links with your work profile and personal links with your personal profile. Microsoft is rolling out Collections to mobile devices. The feature is now available on the iOS and Android versions of Microsoft Edge. FastTrack has deployment guidance for eligible customers and also helps organizations make sure websites are compatible with the new Edge through App Assure.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-gets-new-features-on-desktop-and-mobile/

Windows 10 KB4559004 released to fix broken wireless LTE connectivity

Microsoft has released the KB4559004 non-security preview cumulative update with a fix for an issue that caused Windows 10 computers with wireless wide area network (WWAN) LTE modems to lose Internet connectivity after installing the May KB4556799 update. The issue was resolved for Windows 10, versions 1903 and 1909, an update that will be offered automatically to customers with the latest SSU through Windows Update. Those who haven't yet installed the latest Windows 10 SSU will have to download and install the standalone SSU package through the Microsoft Update Catalog.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-kb4559004-released-to-fix-broken-wireless-lte-connectivity/

Microsoft will disable insecure TLS in Office 365 on Oct 15

Microsoft has set the official retirement date for the insecure Transport Layer Security (TLS) 1.0 and 1.1 protocols in Office 365 starting October 15, 2020, after temporarily halting deprecation enforcement for commercial customers due to COVID-19. IT administrators can use the official KB4057306 documentation to prepare for TLS 1.2 in Office 365 and Office 365 GCC and use Office 365 TLS deprecation report to identify the users and devices that connect to Exchange servers via TLS 1.0/1.1. Microsoft also provides a whitepaper with guidance on how to identify and remove TLS 1.0 dependencies in software built on top of Microsoft operating systems as a starting point for a migration plan to a TLS 1.2+ environment.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-will-disable-insecure-tls-in-office-365-on-oct-15/

Phishing attacks hiding in Google Cloud to steal Microsoft account credentials - TechRepublic

GitHub notified DeepSource earlier this month of detecting malicious activity related to the startup's GitHub app after one of their employees fell victim to the Sawfish phishing campaign. DeepSource provides developers with automated static code analysis tools for GitHub, GitLab, and Bitbucket repositories that help spot and fix issues during code review. Sawfish's operators targeted GitHub users starting with April 2020 as part of a series of spearphishing attacks specifically planned out to steal their credentials using phishing landing pages mimicking GitHub's login page. DeepSource notified all its users via e-mail about this security incident and plans to launch a security bug bounty program to have security researchers investigate its systems for security vulnerabilities.

See the full report here: https://www.techrepublic.com/article/phishing-attacks-hiding-in-google-cloud-to-steal-microsoft-account-credentials/

Leak Exposes Private Data of Genealogy Service Users

An Elastic server containing information of users of a genealogy service has exposed the data of 60,000 users, putting them at risk for fraud, phishing, and other cybercriminal activity. The server belonged to Software MacKiev that currently maintains the Family Tree Maker, or FTM, software, which in turn syncs user data of a widely-known family history search platform, Ancestry.com. The leak exposed a MacKiev server with 25 gigabytes of Ancestry user data and MacKiev Software user subscriptions, including information such as email addresses, user location, user support messages, and technical data. Most of the users whose data was leaked appear to be U.S. residents. Though the company didn’t confirm the incident, researchers noticed that the database was secured after notification.

See the full report here: https://threatpost.com/leak-exposes-private-data-of-genealogy-service-users/157612/

Prometei botnet exploits Windows SMB to mine for cryptocurrency

Researchers at Cisco Talos have discovered a new botnet, dubbed as Prometei, which exploits the Microsoft Windows SMB protocol to move laterally across systems while covertly mining for cryptocurrency. It uses an extensive modular system and a variety of techniques to compromise systems and hide its presence from end-users to mine for Monero (XMR). Prometei's infection chain begins with the attempted compromise of a machine's Windows Server Message Block (SMB) protocol via SMB vulnerabilities including Eternal Blue. In total, the botnet has over 15 executable modules that are controlled by one main module. The botnet is organized into two main function branches, one C++ branch dedicated to cryptocurrency mining operations, and the other one based on .NET focuses on credential theft, the abuse of SMB, and obfuscation. Once a system has been compromised and added to the slave network, the attacker can perform a variety of tasks, including executing programs and commands, launching command shells, setting RC4 encryption keys for communication, opening, downloading, and stealing files, and launching cryptocurrency mining operations, among other functions. Prometei C2 requests have been detected from countries including the US, Brazil, Turkey, China, and Mexico.

See the full report here: https://www.zdnet.com/article/prometei-botnet-is-infecting-machines-to-mine-for-cryptocurrency/

Microsoft Outlook crashes, deletes mails for some POP accounts - BleepingComputer

Some Microsoft 365 customers are experiencing Outlook crashes after updating to Version 2006 Build 13001.20266 and higher. This issue will allow Outlook to delete three or more emails from their inboxes for accounts configured to retrieve mails from a POP (Post Office Protocol) account with Download Headers Only. Customers who need to work around this issue to prevent the Microsoft 365 email client from crashing on their systems and deleting mails can revert to a previous Office version not affected by this problem.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-crashes-deletes-mails-for-some-pop-accounts/

Lazarus Group Surfaces with Advanced Malware Framework

The North Korea-linked APT Lazarus Group, a.k.a. Hidden Cobra or APT 38, has debuted an advanced, multipurpose malware framework, called MATA, to target Windows, Linux, and macOS operating systems. Kaspersky researchers uncovered a series of attacks utilizing MATA, called because the malware authors themselves call their infrastructure MataNet, involving the infiltration of corporate entities around the world in a quest to steal customer databases and distribute ransomware. The framework consists of several components, such as a loader, an orchestrator, which manages and coordinates the processes once a device is infected, and plugins. According to artifacts in the code, Lazarus has been using it since spring 2018. Known organizations hit by the MATA framework have been located in Germany, India, Japan, Korea, Turkey, and Poland.

See the full report here: https://threatpost.com/lazarus-group-advanced-malware-framework/157636/

University of York discloses data breach, staff and student records stolen

The University of York has disclosed a data breach caused by a cyberattack experienced by a third-party service provider. According to the academic institution, names, titles, genders, dates of birth, student numbers, phone numbers, email addresses, physical addresses, and LinkedIn profile records may have been stolen during the incident. Besides, course information, qualifications received, details surrounding extracurricular activities, professions, employers, survey responses, and both documented alumni and fundraising activities may have been exposed. The number of individuals impacted and how many years back the stolen records relate to is not disclosed. The university says that a ransomware attack against Blackbaud, a third-party cloud computing provider, was the cause of the data theft. The university is working with Blackbaud to investigate the data breach.

See the full report here: https://www.zdnet.com/article/university-of-york-discloses-data-breach-staff-and-student-records-stolen/

New ‘Meow’ attack has wiped dozens of unsecured databases

Dozens of unsecured databases exposed on the public web are the target of an automated 'meow' attack that destroys data without any explanation. Databases being "meowed" is a new threat that has spotted recently, and hits Elasticsearch and MongoDB instances randomly without even leaving a ransom note. Meow bot appears to exist mainly to destroy the databases that leave themselves open and exposed online without any security access controls. Using the Shodan Internet-of-Things (IoT) search engine, found that dozens of databases have been affected by this attack. The motive behind the Meow bot attacks is not yet known and not many details found about the attacker(s). Database administrators are recommended to secure the assets and ensure what data is exposed.

See the full report here: https://www.bleepingcomputer.com/news/security/new-meow-attack-has-wiped-dozens-of-unsecured-databases/

Critical SharePoint flaw dissected, RCE details now available

Microsoft released a fix for a remote code execution vulnerability that exists in .NET Framework, Microsoft SharePoint, and Visual Studio. Tracked as CVE-2020-1147, an attacker could upload a specially crafted document to a server utilizing an affected product to process content. Security researcher Steven Seeley provided proof-of-concept on how the flaw can be leveraged against a SharePoint Server instance to gain remote code execution as a low privileged user. This can be used against several applications built with .net. Microsoft recommends the users to prioritize applying the patch.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-sharepoint-flaw-dissected-rce-details-now-available/

Emotet botnet is now heavily spreading QakBot malware

A group of researchers and system administrators united under the name Cryptolaemus to track Emotet botnet noticed that the malware started to push QakBot banking trojan replacing the longtime TrickBot payload across all epochs. An Emotet epoch is a subgroup of the botnet running on a distinct infrastructure. Currently, there are three of them, each with separate command and control servers, distribution methods, and payloads. TrickBot and QakBot are the preferred partners for Emotet. All three actors are part of the same Russian-speaking community and have been interacting for a long time. It is unclear what QakBot drops on infected systems. However, some victims may get ProLock ransomware as a special delivery. Even if there is a different payload, Emotet still relies on emails for malware distribution, with the threat delivered via a malicious document.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-botnet-is-now-heavily-spreading-qakbot-malware/