Threat Intelligence Bulletin: 08/21/2020 - 08/27/2020

Breach Disclosure: Unico Campania

Neapolitan public transport website Unico Campania reported a breach this week that impacted 166,000 users. This breach contained email addresses and passwords which were then circulated online. The company acknowledged the breach and stated that all passwords were reset and they are currently investigating how this breach occurred.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

According to a user on RaidForums, this data was originally posted by another forum user in January 2020, which would contradict claims by the company that they were breached this week. The user posted sample data on the forum and uploaded it for free on a hosting site.

Figure 1: Forum posting of Unico Campania breach data for free

The method of breach or who the perpetrators are is still unknown at this point.

Breach Disclosure: LiveAuctioneers

LiveAuctioneers, a popular online antiques marketplace, was breached in June 2020, impacting over 3.4 million user records. This breach was posted by ShinyHunters on a popular hacking forum in July 2020 and is available for sale at a minimal price.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

LiveAuctioneers is a worldwide online marketplace that hosts thousands of auctions, allowing unprecedented access to remote sales. In July 2020, a threat actor posted the LiveAuctioneers leak on the dark web, stating that the leak impacts over 3.4 million users.

Figure 1. LiveAuctioneers Database available for sale on a popular hacking forum.

The leaked information includes:

Names Email addresses IP addresses Physical addresses Phone numbers Passwords (stored as unsalted MD5 hashes)

Breaking News: 2020-08-21 - 2020-08-27

Instacart discloses security incident caused by two contractors

Grocery delivery and pick-up service Instacart disclosed a security incident caused by two employees working for a company providing tech support services, where they may have reviewed more shopper profiles than was necessary for their roles as support agents. The company learned of the breach during a routine security audit and immediately notified all 2,180 shoppers via email. Although there is no evidence of downloading or copying of data, the company has taken regressive measures to deal with the support agents and the company that hired them.

See the full report here: https://www.zdnet.com/article/instacart-discloses-security-incident-caused-by-two-contractors/

ATM makers Diebold and NCR deploy fixes for 'deposit forgery' attacks

The two biggest ATM manufacturers, Diebold Nixdorf and NCR have released software updates to address bugs that could have been exploited for deposit forgery attacks. Deposit forgery attacks occur when fraudsters try to tamper with an ATM's software to modify the amount and value of currency being deposited on a payment card. Such attacks are usually followed by quick cash withdrawals, either during weekends or via transactions at other banks, with the fraudsters trying to capitalize on the inexistent funds before banks detect any errors in account balances. Diebold Nixdorf patched CVE-2020-9062, an issue impacting ProCash 2100xe USB ATMs running Wincor Probase software, while NCR patched CVE-2020-10124, a bug in SelfServ ATMs running APTRA XFS software.

See the full report here: https://www.zdnet.com/article/atm-makers-diebold-and-ncr-deploy-fixes-for-deposit-forgery-attacks/

Researchers Warn of Flaw Affecting Millions of IoT Devices

IBM’s X-Force Red team has discovered a flaw in the Cinterion’s EHS8 module, a small electronic device embedded in IoT devices that connects to wireless networks and sends and receives data. The module is manufactured by Thales, a French company that designs and builds electrical systems for aerospace markets. However, further testing revealed that five other models in the same product line were also affected (BGS5, EHS5/6/8, PDS5/6/8, ELS61, ELS81, PLS62). The modules store and run Java code, often containing confidential information like passwords, encryption keys, and certificates. The bug is tracked as CVE-2020-15858. If exploited, attackers can potentially access the wealth of confidential data stored by the modules. This may include intellectual property (IP), credentials, passwords, encryption keys, and more. Thales has issued a patch to mitigate this flaw and can be administered by IoT manufacturers in two ways, either by plugging in a USB to run an update via software or by administering an over-the-air (OTA) update.

See the full report here: https://threatpost.com/flaw-affecting-millions-iot-devices/158472/

Malware can no longer disable Microsoft Defender via the Registry

Microsoft has removed the ability to disable Microsoft Defender and third-party security software via the Registry to prevent malware from tampering with protection settings. Microsoft Defender is the built-in antivirus tool that comes bundled with Windows 10. Starting with the August 2020 update, version 4.18.2007.8, Microsoft has discontinued ‘DisableAntiSpyware’ and values will be ignored on client devices. The company also stated that if a user removes their installed antivirus solution, Windows Defender will automatically turn back on to protect them. Now Windows 10 users have far greater protection from threats that tried to disable security software using this technique.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/malware-can-no-longer-disable-microsoft-defender-via-the-registry/

Microsoft brings Windows Subsystem for Linux 2 to Windows 10 1903 and 1909

Microsoft has announced that it is backporting WSL2 (Windows Subsystem for Linux 2) to Windows 10 versions 1903 and 1909. The support comes via a cumulative update that is rolling out to both versions. WSL2 provides a full Linux kernel built into WSL2; improved system call support for all Linux apps, including Docker, FUSE, rsync, and more; and improved file system performance. Currently, the backport to 1903 and 1909 will only be for x64 systems. Customers using the ARM64 version should upgrade to Windows 10 version 2004 to gain full access to WSL 2. To get WSL2 for 1903 and 1909, users need to check for updates via Windows Update.

See the full report here: https://www.zdnet.com/article/microsoft-brings-windows-subsystem-for-linux-2-to-windows-10-1903-and-1909/

Google fixed email spoofing flaw 7 hours after public disclosure

Google addressed an email spoofing vulnerability affecting its Gmail and G Suite products a few hours after it was publicly disclosed. A security researcher published technical details of the email spoofing vulnerability in a blog post, which also includes a proof-of-concept (PoC) code. The vulnerability is caused by missing verifications when configuring mail routes. The issue could have been exploited by an attacker to send an email that appears as sent by another Gmail or G Suite user, the message can bypass protection mechanisms such as Sender Policy Framework (SPF) and Domain-based Message Authentication, Reporting and Conformance (DMARC).

See the full report here: https://securityaffairs.co/wordpress/107360/hacking/google-email-spoofing-flaw.html

IBM Db2 Flaw Gives Attackers Read/Write Access to Shared Memory

Security researchers have discovered a vulnerability in IBM Db2 tracked as CVE-2020-4414 that could let an attacker gain read/write access to shared memory and perform unauthorized actions on a target system. The vulnerability exists because developers neglected to add explicit memory protections around shared memory used by the Db2 trace facility. This could allow any local user to have read and write access to that memory area. All Db2 instances of the current version 11.5 on Windows are affected. IBM has released a patch to address this vulnerability and other security issues.

See the full report here: https://www.darkreading.com/vulnerabilities---threats/ibm-db2-flaw-gives-attackers-read-write-access-to-shared-memory/d/d-id/1338709

Transparent Tribe APT targets government, military by infecting USB devices

Transparent Tribe is involved in campaigns against government and military personnel, revealing a new tool designed to infect USB devices and spread to other systems. In the latest campaign, the attack stems via spear-phishing emails wherein fraudulent messages are sent together with malicious Microsoft Office documents containing an embedded macro that deploys the group's main payload, the Crimson Remote Access Trojan (RAT). If a victim enables macros, the custom .NET Trojan launches and performs a variety of functions, including connecting to a C2 server for data exfiltration and remote malware updates, stealing files, capturing screenshots, and compromising microphones and webcams for audio and video surveillance. Transparent Tribe makes use of a new USB attack tool called USBWorm that is made up of two main components, a file stealer for removable drives and a worm feature for jumping to new, vulnerable machines. If a USB drive is connected to an infected PC, a copy of the Trojan is quietly installed on the removable drive. The malware will list all directories on a drive, and then a copy of the Trojan is buried in the root drive directory. The directory attribute is then changed to "hidden," and a fake Windows directory icon is used to lure victims into clicking on and executing the payload when they attempt to access directories.

See the full report here: https://www.zdnet.com/article/transparent-tribe-hacking-group-spreads-malware-by-infecting-usb-devices/

Free photos, graphics site Freepik discloses data breach impacting 8.3m users

Freepik, a website dedicated to providing access to high-quality free photos and design graphics, has disclosed a major security breach. The company made it official after users started complaining on social media this week about receiving shady-looking breach notification emails in their inboxes. According to the company's official statement, the security breach occurred after a hacker (or hackers) used an SQL injection vulnerability to gain access to one of its databases storing user data. Freepik said the hacker obtained usernames and passwords for the oldest 8.3 million users registered on its Freepik and Flaticon websites. The company is in the process of notifying all impacted users about the incident.

See the full report here: https://www.zdnet.com/article/free-photos-graphics-site-freepik-discloses-data-breach-impacting-8-3m-users/

US govt warns remote workers of ongoing vishing campaign - BleepingComputer

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint advisory warning teleworkers of an ongoing vishing campaign targeting entities from multiple US industry sectors. Vishing (also known as voice phishing) is a type of social engineering attack where the attackers impersonate a trusted entity during a voice call to manipulate their targets into revealing sensitive information. In mid-July 2020, cybercriminals started a vishing campaign where they registered domains used for phishing that cloned the targeted companies' internal VPN login pages, sites that were also able to harvest two-factor authentication (2FA) or one-time passwords (OTP). They used regular VoIP numbers to make calls to targeted employees' cell phones and later switched tactics to spoof the numbers of other company employees and offices to make their attacks more credible. Using social engineering, the attackers gained their targets' trust, eventually convincing them to use a maliciously crafted VPN login that required them to enter 2FA or OTP codes. They then used the employee access to conduct further research on victims, and find ways to monetize access.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-warns-remote-workers-of-ongoing-vishing-campaign/

A Google Drive 'Feature' Could Let Attackers Trick You Into Installing Malware

Google Drive contains an unpatched security flaw that could be exploited by malware attackers to distribute malicious files disguised as legitimate documents or images, enabling bad actors to perform spear-phishing attacks comparatively with a high success rate. The flaw resides in the "manage versions" functionality offered by Google Drive that allows users to upload and manage different versions of a file, as well as in the way its interface provides a new version of the files to the users. Although there's no evidence that this flaw has been exploited in the wild, it could still be used as an attack vector to carry out various phishing attacks.

See the full report here: https://thehackernews.com/2020/08/google-drive-file-versions.html

WordPress WooCommerce stores under attack, patch now - BleepingComputer

WooCommerce WordPress plugin, Discount Rules, is actively being targeted by the hackers to exploit SQL injection, authorization issues, and unauthenticated stored cross-site scripting (XSS) security vulnerabilities. Discount Rules for WooCommerce is a plugin that makes it simple to manage product pricing and discount campaigns on WooCommerce online stores, with more than 30,000 installations. The security flaws in the plugin could allow the attackers to potentially remotely execute code on the vulnerable sites, execute actions with admin permissions, and potentially takeover compromised sites. The flaws in Discount Rules for WooCommerce have been fixed with the release of the latest version 2.1.0. Users are advised to update the plugin to the fixed version as soon as possible to block the attacks designed to potentially take over their sites.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-woocommerce-stores-under-attack-patch-now/

DarkSide: New targeted ransomware demands million dollar ransoms - BleepingComputer

DarkSide, a new ransomware operation, has begun attacking organizations with customized attacks starting earlier this month. According to the researchers, when performing attacks, DarkSide creates a customized ransomware executable for the specific company they are attacking. When executed, the ransomware will execute a PowerShell command that deletes Shadow Volume Copies on the system so that they cannot be used to restore files. It then proceeds to terminate various databases, office applications, and mail clients to prepare the machine for encryption. Each victim will also have a custom extension created using a custom checksum of the victim's MAC address and each executable is customized to include personalized "Welcome to Dark" ransom note, which will include the amount of data that was stolen, the type of data, and a link to their data on the data leak site. The stolen data is then posted to a data leak site under their control and used as part of the extortion attempt.

See the full report here: https://www.bleepingcomputer.com/news/security/darkside-new-targeted-ransomware-demands-million-dollar-ransoms/

Transparent Tribe APT hit 1000+ victims in 27 countries in the last 12 months

The Transparent Tribe APT group is carrying out an ongoing cyberespionage campaign aimed at military and diplomatic targets worldwide. The group upgraded its Crimson RAT by adding a management console and implementing a USB worming capability that allows it to propagate from machines within an infected network. The analysis of the new USBWorm component in Crimson RAT revealed that it works as a downloader, infector, and USB stealer. The infection process begins with cataloging all directories of the victim device, then the malware creates a copy of itself in the drive root directory for each one, using the same directory name. The legitimate directories’ attribute is set to “hidden” while the actual directories are being replaced with a copy of the malware using the same directory name. USBWorm uses an icon that mimics a Windows directory to trick the user into launching the malware when trying to access one of the directories.

See the full report here: https://securityaffairs.co/wordpress/107446/apt/transparent-tribe-apt-2020.html

Adobe released open- source tool Stringlifier to identify randomly generated strings

Adobe has released an open-source tool, dubbed Stringlifier, designed to identify randomly generated strings in any plain text. Stringlifier, written in Python, uses machine learning to identify sequences of random characters inserted in a normal text. The source code of the tool is available on Adobe’s public GitHub repository along with a pre-trained model. Typical usage scenarios include sanitizing application or security logs and detecting accidentally exposed credentials like complex passwords or API keys. Adobe has used the tool to identify random strings within datasets, along with another open-source tool dubbed Tripod.

See the full report here: https://securityaffairs.co/wordpress/107427/security/adobe-open-source-tool-stringlifier.html

Install Windows 10 updates manually with this open-source tool

WuMgr, an update manager for Windows, is a free open-source tool for Windows 10 that allows you to manage Windows Updates without using the first-party tools such as Settings and Control Panel. This portable app requires administrator permissions to run and uses the "Windows Update Agent API" to identify, download and install updates, including Patch Tuesday updates, optional updates, and security updates. This tool could be useful when you're unable to scan, download, or install updates using Windows Update in the Settings app. The source code is available on GitHub.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/install-windows-10-updates-manually-with-this-open-source-tool/

Darknet Empire Market Potentially Victim of DDoS Attack

According to a number of sources, a popular darknet market Empire Market has remained offline for over 36 hours. According to Dark[.]fail, the blackout is a result of a distributed denial-of-service (DDoS) attack after the server was bombarded with artificial traffic.

See the full report here: https://www.itsecurityguru.org/2020/08/24/darknet-empire-market-potentially-victim-of-ddos-attack/

Grandoreiro campaign impersonates Spanish Agencia Tributaria

Operators behind the Grandoreiro banking trojan, which is popular in Latin America, have been using emails posing as the Agencia Tributaria to trick victims into installing the malware. The campaign began on August 11th, 2020, when many Spanish people receiving messages claiming to be from the Agencia Tributaria. The email message includes a link that points to a ZIP archive that claims to contain a digital tax receipt and inform the users that they have to fill a document to be submitted to the Agencia Tributaria along with a fee to pay. The malicious file has been hosted by threat actors either on a compromised domain or in a cloud storage service like Dropbox. In the case of the cloud storage, the link points to a Dropbox folder containing the ZIP file.

See the full report here: https://securityaffairs.co/wordpress/107460/malware/grandoreiro-targets-spain-tax.html

Alexa Bug Gives Hackers Access to Voice History, Personal, and Bank Account Information, Check Point Reveals - CPO Magazine

Researchers at Check Point have discovered a vulnerability in Amazon’s Alexa voice assistant, existing in over 200 million devices shipped worldwide, that could allow hackers to access users’ entire voice history and personal data associated with their Alexa account. Hackers could exploit the newly discovered Amazon Alexa bug by tricking Alexa users into clicking a malicious Amazon link. The attacker can then impersonate the user to access their personal information such as usernames, phone numbers, home addresses, and banking data histories. The attacker could also retrieve the victim’s entire voice history. Amazon has successfully patched the Alexa bug but denies that hackers could access bank information. Users are advised to apply the patches and also delete Alexa's voice history as it exposes the stored data to possibly undisclosed future attacks.

See the full report here: https://www.cpomagazine.com/cyber-security/alexa-bug-gives-hackers-access-to-voice-history-personal-and-bank-account-information-check-point-reveals/

Ransomware Attack Exposes Information of More Than 650K Individuals From Northern Light Health - HealthLeaders Media

Northern Light Health, a Maine-based healthcare system, suffered a ransomware attack that led to the breach of information of over 657,392 individuals. The affected databases include information about donors, potential donors, individuals who may have attended fundraising events, and patients the healthcare system believed may want to donate in the future according to the security notice. However, Blackbaud, a business associate that hosts a database for the Northern Light Health Foundation, confirmed that the exposed data did not include credit card information, bank account information, or social security numbers. Northern Light Health is yet to notify the impacted individuals.

See the full report here: https://www.healthleadersmedia.com/innovation/ransomware-attack-exposes-information-more-650k-individuals-northern-light-health

Ransomware attack hits TFI’s Canadian courier divisions - FreightWaves

TFI International has been hit by a ransomware attack, impacting four Canadian courier divisions, Canpar Express, ICS Courier, Loomis Express, and TForce Integrated Solutions. TFI, Canada’s largest transportation and logistics company stated that their customer shipping needs are not affected by the attack and there is no evidence of misuse of client data. However, TFI has notified its clients about the incident and is currently investigating the attack.

See the full report here: https://www.freightwaves.com/news/breaking-news-tfi-ransomware-attack-hits-canadian-courier-divisions

Lazarus group strikes cryptocurrency firm through LinkedIn job adverts

The Lazarus group is on the hunt for cryptocurrency once more and has launched a targeted attack against a crypto organization by exploiting the human element of the corporate chain. According to F-Secure, the latest Lazarus attack was tracked through a LinkedIn job advert. The human target, a system administrator, received a phishing document in their personal LinkedIn account that related to a blockchain technology company seeking a new sysadmin with the employee's skill set. In this campaign, the Microsoft Word document claimed to be protected under the EU's General Data Protection Regulation (GDPR), and so, the document's content could only be shown if macros were enabled. Once permission is granted, the document's macro creates an LNK file designed to execute a file called mshta[.]exe and call out a bit[.]ly link connected to a VBScript. The infection chain changes depending on system configuration and a range of tools are used by the threat actors.

See the full report here: https://www.zdnet.com/article/lazarus-group-strikes-cryptocurrency-firm-through-linkedin-job-adverts/

Google Project Zero expert found 3 flaws in Apache Web Server

Apache Foundation released the 2.4.46 version to address three flaws affecting its web server software that could be potentially exploited by attackers, under specific conditions, to execute arbitrary code or to trigger a DoS condition by crashing the server. The most severe flaw, tracked as CVE-2020-9490, resides in the HTTP/2 module. An attacker could cause a memory corruption condition by using a specially crafted ‘Cache-Digest’ header leading to a crash and denial of service. The second vulnerability, tracked as CVE-2020-11984, is a buffer overflow issue impacting the “mod_uwsgi” module that could lead to remote code execution. The third flaw, tracked as CVE-2020-11993, is exploitable only when debugging is enabled in the “mod_http2” module, causing logging statements to be made on the wrong connection and resulting in memory corruption due to the concurrent log pool usage. Administrators are recommended to patch their installations immediately.

See the full report here: https://securityaffairs.co/wordpress/107499/security/apache-web-server-flaws.html

Office 365 now opens attachments in a sandbox to prevent infections - BleepingComputer

Microsoft has announced the launch of the Application Guard for Office in public preview to protect enterprise users from threats that use malicious attachments as an attack vector. Application Guard for Office is designed to help prevent block files downloaded from untrusted sources from gaining access to trusted resources by opening them within an isolated sandbox, which automatically blocks maliciously crafted files from exploiting vulnerabilities, downloading other malicious tools, or manifesting any malicious behavior from impacting the users' device and data. By using the Application Guard for Office, users can securely read, edit, print, and save those files without having to re-open files outside the container. Microsoft has provided the instructions on how to deploy and configure Application Guard for Office, as well as licensing and minimum hardware/software requirements.

See the full report here: https://www.bleepingcomputer.com/news/security/office-365-now-opens-attachments-in-a-sandbox-to-prevent-infections/

Security researcher discloses Safari bug after Apple's delays patch - ZDNet

A security researcher has discovered a bug in the Safari browser that could allow hackers to leak or steal files from users' devices. The bug resides in Safari's implementation of the Web Share API, a new web standard that introduced a cross-browser API for sharing text, links, files, and other content. According to the researcher, Safari (on both iOS and macOS) supports sharing files that are stored on the user's local hard drive which is a big privacy issue as this could lead to situations where malicious web pages might invite users to share an article via email with their friends, but end up secretly siphoning or leaking a file from their device. Apple is yet to patch the issue.

See the full report here: https://www.zdnet.com/article/security-researcher-discloses-safari-bug-after-apples-delays-patch/

Google Fixes High-Severity Chrome Browser Code Execution Bug

The Google Chrome web browser is vulnerable to a high-severity flaw that could be used to execute arbitrary code. The vulnerability, tracked as CVE-2020-6492, is a use-after-free vulnerability in the WebGL (Web Graphics Library) component of the Chrome browser. This component is a Javascript API that lets users render 2D and 3D graphics within their browser. This specific flaw stems from the WebGL component failing to properly handle objects in memory. According to the proof-of-concept (PoC) attack outlined by researchers, the issue exists in a function of ANGLE, called “State::syncTextures." Threat actors could manipulate the memory layout of the browser to gain control of the use-after-free exploit, which could ultimately lead to arbitrary code execution. Google has fixed the flaw via Google Chrome’s Beta channel release, but it has been officially rolled out to the Stable channel for version 85.0.4149.0.

See the full report here: https://threatpost.com/google-fixes-high-severity-chrome-browser-code-execution-bug/158600/

Mercenary hacker group targets companies with 3Ds Max malware

Security researchers at Bitdefender have discovered a new hacker group that is currently targeting companies across the globe with malware hidden inside malicious 3Ds Max plugins. 3Ds Max is a 3D computer graphics application developed by software giant Autodesk and is an app commonly installed and used by engineering, architecture, gaming, or software companies. Earlier this month, Autodesk published a security alert about a malicious plugin named "PhysXPluginMfx" that abused MAXScript, a scripting utility that ships with the 3Ds Max software. The malicious plugin is used to deploy a backdoor trojan that hackers could use to scour infected computers for sensitive files and later steal important documents. Information gathered during this investigation revealed that hackers used a malware command and control (C&C) server that was located in South Korea. Researchers appear to believe that this group is yet another example of a sophisticated hacker-for-hire mercenary group that is renting its services to various actors, for the purpose of industrial espionage.

See the full report here: https://www.zdnet.com/article/mercenary-hacker-group-targets-companies-with-3ds-max-malware/

Russian arrested for trying to recruit an insider and hack a Nevada company

The US Department of Justice has announced charges against a Russian citizen who traveled to the US in order to recruit and convince an employee of a Nevada company to install malware on their employer's network in exchange for $1,000,000. According to the court documents, the accused was identified as a member of a larger criminal gang who planned to use the malware to gain access to the company's network, steal sensitive documents, and then extort the victim company for a large ransom payment. He was charged on Monday and faces up to five years in prison for his role in the scheme, if found guilty.

See the full report here: https://www.zdnet.com/article/russian-arrested-for-trying-to-recruit-an-insider-and-hack-a-nevada-company/

Four More Bugs Patched in Microsoft’s Azure Sphere IoT Platform

Cisco Talos researchers recently discovered new vulnerabilities in Microsoft’s IoT security solution. The first two are remote code execution bugs in Microsoft’s IoT security platform called Azure Sphere. Remote code execution vulnerabilities can lead to complete system compromise by executing arbitrary commands on a target machine or in a target process. The rest two are privilege escalation flaws, both rated high-severity and impacting the same cloud security platform. Privilege escalation vulnerabilities allow attackers to impersonate other users, or gain permissions they should not have. Cisco Talos worked with Microsoft to ensure that these issues are resolved and that an update is available for affected customers.

See the full report here: https://threatpost.com/four-more-bugs-patched-in-microsofts-azure-sphere-iot-platform/158643/

DarkSide Ransomware hits North American real estate developer - BleepingComputer

DarkSide, an enterprise targeting ransomware that began operating around August 10th, 2020 has targeted Brookfield Residential. DarkSide breaches a network and spreads laterally between devices while stealing unencrypted data. Once access to a Windows domain controller is gained, the threat actors deploy the ransomware throughout the network. As part of their extortion strategy, DarkSide will create an entry for each victim whose data has been stolen on their data leak site. After a certain amount of time has expired, the data leak site will begin publishing the stolen data so that anyone with access to the site can download it. The stolen data for Brookfield Residential has been released on DarkSide's data leak site and the ransom in demand is currently not known. Brookfield Residential believes that the cyberattack has only affected its employees and is notifying the impacted individuals about the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/darkside-ransomware-hits-north-american-real-estate-developer/

Ryuk successor Conti Ransomware releases data leak site - BleepingComputer

Conti ransomware, the successor of Ryuk ransomware, has launched a data leak site as part of their extortion strategy to force victims into paying a ransom. Conti is a relatively new private Ransomware-as-a-Service (RaaS) that has recruited experienced hackers to distribute the ransomware in exchange for a large share of the ransom payment. Currently, Conti's data leak site lists nearly twenty-six victims, with some of the names being large and well-known companies. For each victim listed, a dedicated page is created that contains samples of the stolen data. If publicly released, this data could expose financial information, personal information of employees, and client data, which leads to a data breach.

See the full report here: https://www.bleepingcomputer.com/news/security/ryuk-successor-conti-ransomware-releases-data-leak-site/

Firefox 80 released with new and faster extensions blocklist - BleepingComputer

Mozilla has released Firefox 80 to the Stable desktop channel for Windows, macOS, and Linux with new features, bug fixes, changes, enterprise improvements, and several security fixes. Firefox 80 enables Mozilla's new add-ons blocklist, which enhances the browser's performance and scalability by lowering the time needed to parse the list when automatically disabling problematic Firefox extensions. Firefox 80 also enables users to set it as their system's default system PDF viewer and fixes several crashes that make the web browser more stable for screen reader users. Users can upgrade to Firefox 80 by going to Options -> Help -> About Firefox and the browser will automatically check for the new update and install it when available.

See the full report here: https://www.bleepingcomputer.com/news/software/firefox-80-released-with-new-and-faster-extensions-blocklist/

Chrome 85 released with security fixes, app shortcuts, AVIF support - BleepingComputer

Google has released Chrome 85 to the Stable desktop channel with numerous security enhancements, features, and APIs for developers. Chrome 85 includes a QR code generator, AVIF image support, better protection from mixed content downloads, further securing of same-site cookies, and app shortcuts for PWAs. Chrome 85 displays a visual warning when downloading mixed content audio, video, images, and ext files. These files include .png, .gif, .jpg, .mp4, etc. Google Chrome will also block mixed content files that are considered non-safe as they can be abused to deliver malware or other malicious activity. These files consist of .pdf, .doc, .docx, .xls, etc. Windows, Mac, and Linux desktop users can upgrade to Chrome 85 by going to Settings -> Help -> About Google Chrome. The browser will then automatically check for the new update and install it when available.

See the full report here: https://www.bleepingcomputer.com/news/google/chrome-85-released-with-security-fixes-app-shortcuts-avif-support/

SunCrypt Ransomware sheds light on the Maze ransomware cartel - BleepingComputer

Ransomware named SunCrypt has joined the Maze cartel. Maze threat actors created a cartel of ransomware operations to share information and techniques to help each other extort their victims. According to Malwarehunterteam, this new ransomware family began operating in October 2019 but was not very active. SunCrypt is an independently run ransomware group and shares a two-way communication channel with Maze, as part of the cartel. They also share revenue from the successful operation. The ransomware is currently being distributed as a DLL that, when executed, will encrypt a computer's files. When encrypting files, it will append a hexadecimal hash to the end of each file name. In every folder, a link to the data leak site and a ransom note named YOUR_FILES_ARE_ENCRYPTED[.]HTML that contains a link to the Tor payment site is created. The Tor payment site does not have automated features and simply contains a chat screen where a victim can negotiate a ransom with the threat actors. Every victim encrypted by SunCrypt executable will have the same Tor payment site link.

See the full report here: https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-sheds-light-on-the-maze-ransomware-cartel/

Medical Data Leaked on GitHub Due to Developer Errors

A Dutch researcher has recently discovered nine separate files of highly sensitive personal health information (PHI) from apps such as Office 365 and Google G Suite from nine separate health organizations. Approximately, 150,000 to 200,000 patient health records were exposed due to developers’ improper configuration of access controls and hard-coded credentials in the storing of the information. Patient data found in the files was from health organizations Xybion, MedPro Billing, Texas Physician House Calls, VirMedica, MaineCare, Waystar, Shields Health Care Group, and AccQData.

See the full report here: https://threatpost.com/medical-data-leaked-on-github-due-to-developer-errors/158653/

DeathStalker cyber-mercenary group targets the financial sector

Security researchers at Kaspersky have discovered a hack-for-hire group dubbed DeathStalker that has been targeting organizations worldwide, mainly law firms and financial entities, since 2012. In recent attacks, DeathStalker mercenaries employed the PowerShell-based implant Powersing that allows the attacker to periodically sends screenshot captures to the C2, and to execute arbitrary PowerShell scripts received from the C2. The attackers used spear-phishing messages with an archive containing a malicious LNK file. Upon clicking the shortcuts, arbitrary code gets executed on the victim’s machine. The malicious code further allows threat actors to install additional tools. DeathStalker leveraged multiple public services including Google+, Imgur, Reddit, ShockChan, Tumblr, Twitter, YouTube, and WordPress as dead drop resolvers. These services provide a way for attackers to store data at a fixed URL through public posts, comments, user profiles, content descriptions, etc. Powersing connects the drop resolvers to retrieve the stored information, decode it, and ultimately convert into an IP address that the malware uses to connect to the real C&C server.

See the full report here: https://securityaffairs.co/wordpress/107532/cyber-warfare-2/deathstalker-hacking-group.html

US Warns of Ongoing BeagleBoyz Bank-Theft Operations

US law enforcement and government agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury, the FBI, and the US Cyber Command, have issued a joint technical alert concerning an ongoing campaign by the North Korean government to rob banks through an ATM cash-out scheme. The campaign, dubbed "FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks," is an international operation designed to initiate fraudulent international money orders and ATM cash-outs. The BeagleBoyz is an element of the North Korean government's Reconnaissance General Bureau and has been active since at least 2014. The group conducts well-planned, disciplined, and methodical cyber operations akin to careful espionage activities. In the operation, North Korean operatives seek to gain unauthorized access to networks, point-of-sale systems, and ATMs belonging to their victims.

See the full report here: https://www.darkreading.com/attacks-breaches/us-warns-of-ongoing-beagleboyz-bank-theft-operations/d/d-id/1338768

DDoS extortionists target NZX, Moneygram, Braintree, and other financial services

For the past weeks, a criminal gang has launched DDoS attacks against some of the world's biggest financial service providers and demanded Bitcoin payments as extortion fees to stop their attacks. The group uses names like Armada Collective and Fancy Bear, both borrowed from more famous hacker groups to email companies and warning of an impending DDoS attack against their company unless a ransom is paid in Bitcoin. The group has attacked money transfer service MoneyGram, YesBank India, PayPal, Braintree, and Venmo and New Zealand stock exchange (NZX). According to Akamai, the group launched complex DDoS attacks, peaked at 200 Gb/sec, utilizing ARMS, DNS Flood, GRE Protocol Flood, SNMP Flood, SYN Flood, and WSDiscovery Flood attacks as their main vectors, challenging protection controls. DDoS mitigation providers recommend that companies do not give in to these types of extortion attempts.

See the full report here: https://www.zdnet.com/article/ddos-extortionists-target-nzx-moneygram-braintree-and-other-financial-services/

Microsoft postpones Windows 10 1803 end of support date for some users - ZDNet

Microsoft is pushing back the end of support date for Windows 10 version 1803 for certain classes of users. The initial end of support date was slated for November 10, 2020. Microsoft will continue to release monthly security updates for Enterprise, Education, and IoT Enterprise editions through Windows Update, Windows Server Update Services and the Microsoft Update Catalog, until May 11, 2021. According to Microsoft, the reason for the revision of the end of support date is user feedback indicating businesses needed more continuity and time amid the COVID-19 coronavirus pandemic

See the full report here: https://www.zdnet.com/article/microsoft-postpones-windows-10-1803-end-of-support-date-for-some-users/