Threat Intelligence Bulletin: 08/28/2020

Breach Disclosure: Experian South Africa

In May 2020, Experian South Africa experienced a data breach involving 24 million South Africans and 793,749 local businesses, which was discovered by Experian in July 2020 and reported to regulators in August of 2020. According to iAfrikan, the actor responsible for the data breach had a previous relationship with Experian, and received a download link from the company to the data.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

As mentioned, it was reported that Experian South Africa assumed they were dealing with a legitimate client, and handed over two sets of data for millions of South Africans. Once the actor obtained the data, they uploaded it to various websites and forums in 2 sets of data, the first one being the data on the 24 million South Africans, the other being credit or financial information.

The first set of data on the 24 million South Africans contained the following column names:

RSAID Forename1 surname CS_File_number CS_CST_HomeAffairsRSAIDVerf CS_CELL_PHONE_1 CS_CELL_PHONE_2 CS_CELL_PHONE_3 CS_HOME_PHONE_1 CS_HOME_PHONE_2 CS_HOME_PHONE_3 CS_OTHER_PHONE_1 CS_OTHER_PHONE_2 CS_OTHER_PHONE_3 CS_WORK_PHONE_1 CS_WORK_PHONE_2 CS_WORK_PHONE_3 CS_EMAIL CS_EMAIL_RANK CS_Employer CS_OCCUPATION CS_Date CS_EMP1_EMP_NAME CS_EMP1_DATE_CREATED CS_EMP1_OCCUPATION CS_EMP2_EMP_NAME CS_EMP2_DATE_CREATED CS_EMP2_OCCUPATION CS_EMP3_EMP_NAME CS_EMP3_DATE_CREATED CS_EMP3_OCCUPATION CS_Address1_Line_1 CS_Address1_Line_2 CS_Address1_Line_3 CS_Address1_Line_4 CS_Address1_Town CS_Address1_PostCode CS_Address1_Province CS_Address1_Update_Date CS_Address2_Line_1 CS_Address2_Line_2 CS_Address2_Line_3 CS_Address2_Line_4 CS_Address2_Town CS_Address2_PostCode CS_Address2_Province CS_Address2_Update_Date CS_Address3_Line_1 CS_Address3_Line_2 CS_Address3_Line_3 CS_Address3_Line_4 CS_Address3_Town CS_Address3_PostCode CS_Address3_Province CS_Address3_Update_Date

The other data set on businesses in South Africa contained the following column names:

Kim#
Debtor Name Vat Matched Flag Legal Name Alt Name Type Alt Name Name Change Type Changed Name Entity Company Status
Reg Number
Report Date
Enquiry Amount
Enquiry Terms
Bank Code
Bank Code Date Sicc Source
Sicc
Sicc Description
Employees
Holding Company
Turnover Range Import/Export
Fleet
Score
Score Comment
Judgements
R/D Cheques
Adverse References
Telephone
Postal Address
Street Address Province
Principals
Branches
Liquidation
Premises
VAT Number
Ultimate Holding Company
Last JU Date
Auditor Fax
E-mail
Bankers Account#
Branch
BEE
NCA

Both of these data sets provide an ample amount of data to hackers to be used in compromising accounts, pre-texting, or any other fraudulent activities. However, Experian stated "Our investigations also show that the suspect had intended to use the data to create marketing leads to offer insurance and credit-related services.", but due to conflicting information from Experian's investigation and the one from iAfrikan, it is unknown if this is factual.

Breaking News: 2020-08-28 - 2020-09-03

Iranian hackers impersonate journalists to set up WhatsApp calls and gain victims' trust

Iranian hackers have impersonated journalists to reach out to targets via LinkedIn and set up WhatsApp calls to win their trust, before sharing links to phishing pages and malware-infected files. According to Israeli cyber-security firm ClearSky, the hackers are believed to be members of Iranian super group CharmingKitten, also known as APT35, NewsBeef, Newscaster, or Ajax. In the recent campaign, hackers targeted academia experts, human rights activists, and journalists specialized in Iranian affairs. The hackers contacted victims first via LinkedIn messages, where they posed as Persian-speaking journalists working for German broadcasting company Deutsche Welle and Israeli magazine Jewish Journal. After making contact, the attackers attempted to set up a WhatsApp call with the target and discuss Iranian affairs to gain the target's trust. Following this initial call, victims eventually received a link to a compromised Deutsche Welle domain that either hosted a phishing page or a ZIP file containing malware capable of dumping and stealing their credentials.

See the full report here: https://www.zdnet.com/article/iranian-hackers-impersonate-journalists-to-set-up-whatsapp-calls-and-gain-victims-trust/

Revamped Qbot Trojan Packs New Punch: Hijacks Email Threads

Security researchers at Checkpoint have discovered a new version of trojan that is spreading fast and already has claimed 100,000 victims globally. Attacks attributed to the Qbot trojan, an ever-evolving information-stealing trojan that’s been around since 2008, has shifted tactics again and adopted new techniques. Once installed, the trojan sends specially crafted emails to the target organizations or individuals, each with a URL to a ZIP with a malicious Visual Basic Script (VBS) file, which contains code that executes within Windows. It then activates a special “email collector module” to extract all email threads from the victim’s Outlook client and uploads it to a hardcoded remote server. These stolen emails are then utilized for future malspam campaigns. The malware can steal information from infected machines, including passwords, emails, and credit card details. It also can install malware, including ransomware, on other machines, or connect to a victim’s computer using the Bot controller to make bank transactions from that IP address.

See the full report here: https://threatpost.com/revamped-qbot-trojan-packs-new-punch-hijacks-email-threads/158715/

Academics bypass PINs for Visa contactless payments

A team of academics from Switzerland has discovered a security bug that can be abused to bypass PIN codes for Visa contactless payments. A successful attack requires four components: two Android smartphones, a special Android app developed by the research team, and a Visa contactless card. The Android app is installed on smartphones, which will work as a card emulator and a POS (Point-Of-Sale) emulator. POS emulator asks the card to make a payment, modifies transaction details, and then sends the modified data via WiFi to the second smartphone that makes a large payment without needing to provide a PIN. Besides the PIN bypass on Visa contactless cards, used a modified version of a tool called Tamarin discovered a second security issue impacting both Mastercard and Visa. The vulnerability enables criminals to trick the terminal into accepting an unauthentic offline transaction with a Visa or an old Mastercard card.

See the full report here: https://www.zdnet.com/article/academics-bypass-pins-for-visa-contactless-payments/

Lemon_Duck cryptominer malware now targets Linux devices - BleepingComputer

The Lemon Duck crypto-mining malware has been updated to compromise Linux machines via SSH brute force attacks, to exploit SMBGhost-vulnerable Windows systems, and to infect servers running Redis and Hadoop instances. The crypto jacked is being distributed to potential victims via large-scale COVID-19-themed spam campaigns that make use of an RTF exploit targeting the CVE-2017-8570 Microsoft Office remote code execution (RCE) vulnerability to deliver the malicious payload. Lemon Duck's authors have also added a module that exploits the wormable pre-auth SMBGhost (CVE-2020-0796) Windows SMBv3 Client/Server RCE vulnerability. Instead of exploiting this security flaw on vulnerable systems to run arbitrary code, the malware's operators are using this module to collect information on compromised machines. Support for scanning for and hacking into servers running exposed Redis (REmote DIctionary Server) databases and Hadoop clusters managed using YARN (Yet Another Resource Negotiator) is also added to the malware.

See the full report here: https://www.bleepingcomputer.com/news/security/lemon-duck-cryptominer-malware-now-targets-linux-devices/

350 million decrypted email addresses left exposed on an unsecured server

The CyberNews research team uncovered an unsecured data bucket owned by an unidentified party, containing seven gigabytes worth of unencrypted files that include 350,000,000 strings of unique email addresses separated into three groups: hashed, hashed and salted, and unencrypted files. The unsecured bucket was located in the US and hosted on a publicly accessible Amazon S3 server, that has been exposed for what seems to be at least 18 months, allowing anyone to download and access the data. The exposed bucket contained 67 CSV files. Besides the CSV files, the bucket also contained voice recordings of several sales pitches to digital marketers about RepWatch. Users are advised to change the password and enable two-factor authentication (2FA).

See the full report here: https://securityaffairs.co/wordpress/107604/data-breach/email-addresses-data-leak.html?utm_source=rss&utm_medium=rss&utm_campaign=email-addresses-data-leak

Single & penniless: FBI warns of $475M lost to romance scams - BleepingComputer

The FBI has issued a warning against the recent online romance scams. It is an ongoing online fraud trend that can lead to large financial losses, as well as devastating emotional scars. The scammers behind this type of fraud use fake online identities to gain their victims' trust on social media and dating websites. Once the targets are lured in, they take advantage of the illusion of a romantic relationship to manipulate them into sending them money or financial information later to be used in other types of fraud schemes. Victims of the scam should stop all contacts and file a complaint and also reach out to the financial institutions for illegal transactions.

See the full report here: https://www.bleepingcomputer.com/news/security/single-and-penniless-fbi-warns-of-475m-lost-to-romance-scams/

UltraRank hackers steal credit cards from hundreds of stores - BleepingComputer

Security researchers at Group-IB have discovered a cybercriminal group which specializes in infecting online shops to steal payment card data and has compromised over 700 websites and more than a dozen third-party service providers. Named UltraRank, the gang has been active since at least 2015 and has been using several web skimmers, malicious JavaScript code also known as JS sniffers. The hackers inject malicious code into the scripts of the products offered by targeted companies. These products are subsequently placed on web resources of online stores. Cybercriminals are able to intercept customer bank card data on all online stores where the infected scripts were used. The group has gained a hefty profit by selling the stolen account on dark web marketplaces.

See the full report here: https://www.bleepingcomputer.com/news/security/ultrarank-hackers-steal-credit-cards-from-hundreds-of-stores/

Instagram ‘Help Center’ Phishing Scam Pilfers Credentials

Researchers warn that a phishing scam is targeting Instagram users via direct messages on the app. The campaign has been targeting celebrities, startup business owners, and other entities with sizeable followings on Instagram. The attackers in this campaign send the phishing messages on Instagram’s platform itself. They pretend to be the Instagram Help Center and claim that a copyright violation complaint has been filed against the account owner. The message also provides a link that masquerades as a form for sending an appeal where the user will be requested to provide their username. Upon clicking the "next" button, another screen appears that asks their name, password, email address, and email password. If a victim inputs his credentials and clicks the “Continue” button, the page redirects to the legitimate Instagram login page. Once the attackers gain access to the Instagram credentials, they log in to the account, unlink the victim’s cellphone number connected to the account, and change the email linked to the account. Further, attackers can take over the email account as well. Instagram users are advised to be cautious of seemingly legitimate sites that request account credentials for another site.

See the full report here: https://threatpost.com/instagram-help-center-phishing-scam-pilfers-credentials/158777/

Malicious npm package caught trying to steal sensitive Discord and browser files

The npm security team has removed a malicious JavaScript library from the npm portal that was designed to steal sensitive files from an infected users' browser and Discord application. The malicious package was a JavaScript library named "fallguys" that claimed to provide an interface to the "Fall Guys: Ultimate Knockout" game API. The developers downloaded the library, integrated it inside their projects, and ran their code on the infected dev wherein the malicious package was also executed. The code attempts to access five local files, read their content, and then post the data inside a Discord channel. The malicious package appears to have been performing some sort of reconnaissance, gathering data on victims, and trying to assess what sites the infected developers were accessing before delivering more targeted code via an update to the package later. The npm security team has advised developers to remove the malicious package from their projects.

See the full report here: https://www.zdnet.com/article/malicious-npm-package-caught-trying-to-steal-sensitive-discord-and-browser-files/

Anubis, a new info-stealing malware spreads in the wild

Microsoft warned of a recently uncovered piece of malware, tracked as Anubis that was designed to steal information from infected systems. Anubis is the name of an Android malware well-known in the community of malware analysts, but the family reported by Microsoft is not related to it. Anubis has been around since June, appeared on several cybercrime forums, and is now actively distributed in the wild. According to Microsoft, the new piece of malware uses code forked from Loki malware to steal system info, credentials, credit card details, cryptocurrency wallets, and it only targets Windows systems.

See the full report here: https://securityaffairs.co/wordpress/107591/malware/anubis-info-stealing-malware.html?utm_source=rss&utm_medium=rss&utm_campaign=anubis-info-stealing-malware

Slack fixes major vulnerability that left desktop users open to attack - Mashable

Slack contained a critical remote code execution vulnerability that could allow hackers to gain access to private conversations, private files, private keys, passwords, secrets, internal network access, and much more within Slack. This security flaw in Slack could also have allowed maliciously inclined hackers to carry out "wormable" attacks. This means, if one person gets infected, their account would automatically re-share the dangerous payload to all their contacts. Slack has fixed the issue.

See the full report here: https://mashable.com/article/slack-fixes-critical-remote-code-execution-vulnerabilitybug-bounty/

Microsoft to remove insecure TLS support on its Linux Software Repository - BleepingComputer

To support modern security standards, Microsoft has announced to discontinue support for the insecure TLS 1.0 and TLS 1.1 protocols on its Linux Software Repository starting with September 24, 2020. As part of the same move to increase customers' security and privacy, Microsoft said earlier this month that TLS 1.3 will be enabled by default in all Windows 10 Insider Preview builds beginning with Build 20170 as the start of a wider rollout to all systems running Windows 10. According to Microsoft, TLS 1.3 eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the handshake as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-to-remove-insecure-tls-support-on-its-linux-software-repository/

Emotet malware's new 'Red Dawn' attachment is just as dangerous - BleepingComputer

The Emotet botnet has started using a new template for their malicious attachments, and it is just as dangerous as ever. Emotet's spam campaigns are camouflaged as invoices, shipping information, COVID-19 information, resumes, financial documents, or scanned documents. According to security researchers, on August 25th, the botnet switched to a new template dubbed 'Red Dawn' due to its red accent colors. The Red Dawn template also moves away from its iOS theme and now states that "This document is protected" and that previewing is not available. It then prompts the user to click on 'Enable Editing' and 'Enable Content' to view the document. Once enable content is clicked, malicious macros will be executed that download and install the Emotet malware on a victim's computer.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malwares-new-red-dawn-attachment-is-just-as-dangerous/

Dynasplint Systems Announces Data Breach that May Have Affected 102,800 Patients - The Legal Herald

Dynaplint Systems, a manufacturer and seller of splint systems to help patients who have a limited range of motion, reportedly suffered a data breach, exposing sensitive information belonging to over 102,800 individuals. Investigations have revealed that the attackers may have accessed sensitive information that includes names, addresses, social security numbers, and medical information. Dynasplint has notified the impacted individuals and has offered the potential victims credit monitoring services for the next year.

See the full report here: https://legalherald.com/dynasplint-systems-announces-data-breach-that-may-have-affected-102800-patients/

Utah Pathology Services reports data breach - Gephardt Daily

Utah Pathology Services has reported a data breach after an unknown third party attempted to redirect funds from the company. The information accessed by the unauthorized party included names and one or more of the following personal attributes: date of birth, gender, phone number, mailing address, email address, insurance information including ID and group numbers, medical and health information including internal record numbers and clinical and diagnostic information related to pathology services, and, for a small percentage of patients, Social Security number. Currently, Utah Pathology Services does not have evidence that any patient information has been misused. However, they have notified all potentially affected patients about the breach and are offering them free identity monitoring for 12 months.

See the full report here: https://gephardtdaily.com/local/utah-pathology-services-reports-data-breach/

Facebook sues MobiBurn, Nikolay Holper for malware, auto-bots - USA Herald

Facebook has filed a lawsuit against MobiBurn, OakSmart Technologies, and its founder Fatih Haltas in the High Court of Justice in London. Facebook claims that MobiBurn paid third-party app developers to install the malicious Software Development Kit (SDK) into their apps. And when the malware apps were installed on a device, MobiBurn was able to collect information on Facebook users, including name, time zone, email address, and gender. Facebook is also suing developer Nikolay Holper for violating its policies by operating a “fake engagement service” to sell fake “likes” on Instagram. Facebook claims that Nikolay Holper used a network of bots and automation software to distribute fake likes, comments, views, and followers on Instagram.

See the full report here: https://usaherald.com/facebook-sues-mobiburn-nikolay-holper/

CenturyLink routing issue led to outages on Hulu, Steam, Discord, more - BleepingComputer

According to numerous reports from affected customers, a BGP routing issue at CenturyLink where they were not correctly routing portions of the Internet has caused outages for numerous Internet-connected services such as Cloudflare, Amazon, Garmin, Steam, Discord, Blizzard, and many more. CenturyLink stated that their Level3 CA3 data center has caused the outage and are investigating the issue. The outage has since been resolved, and services are slowly recovering, with some areas taking longer than others. However, CenturyLink is yet to update its status message or publicly confirm that the outage was due to a BGP routing issue.

See the full report here: https://www.bleepingcomputer.com/news/technology/centurylink-routing-issue-led-to-outages-on-hulu-steam-discord-more/

Google Play apps promised free shoes, but users got ad fraud malware instead

Security researchers at White Ops have discovered a botnet named Terracotta that operated by uploading apps on the Google Play Store, which promised users free perks if they installed the applications on their devices. The apps claimed to offer free shoes, sneakers, boots, and sometimes tickets, coupons, and expensive dental treatments. Users were told to install the app and wait for two weeks to receive the free products, during which time they had to leave the app installed on their smartphone. The apps downloaded and ran a modified version of WebView, a slimmed-down version of Google Chrome. The Terracotta gang launched the modified WebView browser, hidden from the user's view, and performed ad fraud by loading ads and gaining revenue from fake ad impressions. Google has removed some of the Android applications from the official Google Play Store that the company says were part of the Terracotta botnet. However, the botnet's presence on the Play Store has not been removed altogether, with some devices still appearing to be infected.

See the full report here: https://www.zdnet.com/article/google-play-apps-promised-free-shoes-but-users-got-ad-fraud-malware-instead/

Paytm Mall suffers massive data breach as hackers gain 'unrestricted access' into database: Report - Moneycontrol

An e-commerce payment system and financial technology company Paytm has suffered a massive data breach after a hacker group targeted the company’s PayTM Mall database. According to Cyble, a hacker group called John Wick was able to upload a backdoor or Adminer on the Paytm Mall application website and was able to gain unrestricted access to their entire databases, which affects all accounts and related information at the Paytm Mall. The volume of data breached is currently unknown. The attackers are demanding a ransom of 10 ETH, equivalent to USD 4,000 in exchange for the data. Paytm has denied the claim and is investigating the breach internally.

See the full report here: https://www.moneycontrol.com/news/technology/paytm-mall-suffers-massive-data-breach-as-hackers-gain-unrestricted-access-report-5773391.html

American Payroll Association discloses credit card theft incident - BleepingComputer

The American Payroll Association (APA) has reported a data breach after attackers successfully planted a web skimmer on the organization's website login and online store checkout pages, impacting members and customers. On July 23, 2020, APA discovered that its website and online stores were breached by unknown threat actors who deployed a skimmer designed to collect and exfiltrate sensitive information to attacker-controlled servers. The attackers used a security vulnerability in the organization's content management system (CMS) to hack into APA's site and online stores. The hackers gained access to login information such as username and password and individual payment card information such as credit card information and associated data. Furthermore, in some cases, the attackers were also able to gain access to social media usernames and profile photos of the impacted APA members and customers. Following the attack, APA installed the latest security updates for their site's and store's CMS to block future exploitation attempts. The company has also reset passwords for all affected users, and it's offering $1,000,000 in identity theft insurance and one year of free credit monitoring.

See the full report here: https://www.bleepingcomputer.com/news/security/american-payroll-association-discloses-credit-card-theft-incident/

Malware authors trick Apple into trusting malicious Shlayer apps - BleepingComputer

The authors of the Mac malware known as Shlayer have successfully managed to get their malicious payloads through Apple's automated notarizing process. A security researcher has discovered notarized Shlayer adware installers being distributed through a fake and malicious Homebrew website, installers that could be executed on any Mac running macOS Catalina without being automatically blocked on launch. This allowed the threat actors behind this adware campaign to deliver their payloads to systems where the installers would have been previously blocked. Apple immediately revoked the certificates on the same day of reporting. However, the researcher found that the Shlayer campaign was still going strong, serving new payloads notarized the day Apple revoked the initial sample's certificates.

See the full report here: https://www.bleepingcomputer.com/news/security/malware-authors-trick-apple-into-trusting-malicious-shlayer-apps/

Cisco warns of actively exploited bug in carrier-grade routers - BleepingComputer

Cisco has warned about a high severity memory exhaustion denial-of-service (DoS) vulnerability in Cisco IOS XR software that runs on carrier-grade routers, which the threat actors are trying to exploit. Tracked as CVE-2020-3566, the bug exists in the Distance Vector Multicast Routing Protocol (DVMRP) feature of the IOS XR software and affects any Cisco device running any Cisco IOS XR Software release if one of their active interfaces is configured under multicast routing. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. Cisco is yet to release software updates to address CVE-2020-3566. However, Cisco recommends implementing appropriate mitigations published in its security advisory.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-warns-of-actively-exploited-bug-in-carrier-grade-routers/

Healthcare Key Target of Hacker Selling Access to Compromised RDP - HealthITSecurity.com

TrueFighter, a malicious actor targeting remote desktop protocol (RDP) accounts across all sectors, with those in the healthcare industry as the leading target. The hacker then sells access to the compromised RDP on the dark web for financial gain, according to Nuspire. TrueFighter is a member of multiple underground communities and forums. Anyone who buys these accounts would obtain remote administrative access to the compromised organization. Admins are advised to restrict access to RDP connections to trusted sources and implement 2FA for RDP logins.

See the full report here: https://healthitsecurity.com/news/healthcare-key-target-of-hacker-selling-access-to-compromised-rdp

Windows 10 2004 now blocked on devices with LTE cellular modems - BleepingComputer

Microsoft has acknowledged a known issue affecting Windows 10 devices with WWAN LTE cellular modems. Some devices with WWAN LTE modems might be unable to connect to the internet and may show no internet connection in the Network Connectivity Status Indicator (NCSI) within Windows 10's notification area. According to Microsoft, this issue affects Windows 10, version 2004 desktop platforms only. The company has applied a safeguard hold on all Windows 10 devices with affected WWAN LTE modems drivers, preventing Windows 10 2004 from being offered through Windows Update until the issue is resolved. Microsoft urges customers not to attempt to manually update to the latest Windows 10 version using the Media Creation Tool or the Update now button.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-2004-now-blocked-on-devices-with-lte-cellular-modems/

Credit card data smuggled via private Telegram channel - BleepingComputer

Security researchers have noticed that some cybercriminals attacking online stores are using private Telegram channels to steal credit card information from customers purchasing victim sites. Researchers analyzed the malicious JavaScript and observed that it collects data from the input field and sends it to a Telegram channel. All the information is encrypted using a public key and a Telegram bot then posts the stolen data in a chat as a message. The data exfiltration begins only if the browser’s current URL contains a keyword indicative of a shopping site and when the user validates the purchase. This attack mechanism eliminates the need for data exfiltration infrastructure and helps in evading detection via security solutions.

See the full report here: https://www.bleepingcomputer.com/news/security/credit-card-data-smuggled-via-private-telegram-channel/

Iranian hackers are selling access to corporate networks - BleepingComputer

An Iranian-backed hacker group has been observed selling access to compromised corporate networks to other threat actors on underground forums and attempting to exploit F5 BIG-IP devices vulnerable to CVE-2020-5902 exploits. The group has been active since at least 2017 and is being identified by different names including Pioneer Kitten, Fox Kitten, and Parisite. The hacking group is known for exploiting vulnerabilities in Internet-exposed Fortinet (CVE-2018-13379), PulseSecure (CVE 2019-11510, CVE 2019-11539), Citrix ADC/Gateway (CVE 2019-19781), and Palo Alto Networks VPN (CVE-2019-1579) appliances to gain access to companies' corporate and industrial networks. In July, they switched tools to target enterprises with vulnerable BIG-IP application delivery controllers (ADC). The group’s targeting behavior seems to be highly opportunistic as its targets including entities from a long list of countries including the U.S., Israel, Germany, Australia, France, Austria, Finland, Hungary, Italy, Kuwait, Lebanon, Malaysia, Poland, Saudi Arabia, and UAE.

See the full report here: https://www.bleepingcomputer.com/news/security/iranian-hackers-are-selling-access-to-corporate-networks/

Firefox 80.0.1 rolls out to fix crashes and download issues

Mozilla released Firefox 80.0.1, an out of band update designed to fix crashes caused by GPU resets and issues affecting downloads triggered by browser extensions. The new version also fixes rendering issues on some websites that are using WebGL to render content, a bug that leads to the broken text being rendered on Linux systems with Xorg and NVIDIA graphics and Windows 10 devices with Direct3D 11. It also addresses a performance regression when encountering new intermediate CA certificates and the zoom-in keyboard shortcut on the Japanese language builds. Users can download the updated release from Mozilla's FTP release directory.

See the full report here: https://www.bleepingcomputer.com/news/software/firefox-8001-rolls-out-to-fix-crashes-and-download-issues/

Researchers warn of QNAP NAS attacks in the wild

Hackers are scanning the Internet for vulnerable network-attached storage (NAS) devices running multiple QNAP firmware versions vulnerable to a remote code execution (RCE) vulnerability that was addressed by the vendor 3 years ago. According to researchers, the attackers are exploiting the remote command execution vulnerability due to a command injection issue that resides in the firmware QNAP NAS devices. An unauthenticated, remote attacker could exploit the flaw to achieve authentication using the authLogout[.]cgi executable because it doesn’t filter out special characters from the input before invoking the system function to run the command string. QNAP addressed the vulnerability with the release of firmware version 4.3.3 on July 21, 2017. The fix proposed by the vendor replaces the function used to run the command strings.

See the full report here: https://securityaffairs.co/wordpress/107750/hacking/qnap-nas-attacks.html

Norway ‘s Parliament, Stortinget, discloses a security breach

Norway’s parliament, Stortinget, announced that it was the target of a major cyber-attack that allowed hackers to access emails and data of a small number of parliamentary representatives and employees. The IT staff at the parliament had detected anomalies a little more than a week ago. Following this, the IT staff has shut down its email service to prevent hackers from exfiltrating sensitive data. The Stortinget has already started notifying impacted representatives, employees about the security breach, and an investigation is in place.

See the full report here: https://securityaffairs.co/wordpress/107793/cyber-warfare-2/norway-parliament-hacked.html

Magento Sites Vulnerable to RCE Stemming From Magmi Plugin Flaws

Security researchers have discovered and released proof-of-concept (PoC) exploit code for the flaws in Magento Mass Import (Magmi) plugin, an open-source database client that imports data into Magento. The two flaws are tracked as CVE-2020-5776, a cross-site request forgery (CSRF) vulnerability affecting Magmi up to version 0.7.24, and CVE-2020-5777, an authentication bypass flaw in Magmi for Magento version 0.7.23 and below. According to the researchers, a patch has been published for the flaw (CVE-2020-5777), in Magmi version 0.7.24. However, at the time of discovery, there was still no patch available for the second flaw (CVE-2020-5776).

See the full report here: https://threatpost.com/magento-sites-vulnerable-to-rce-stemming-from-magmi-plugin-flaws/158864/

Reduced lifespan of TLS certificates could cause increase in outages

Starting September 1st, all publicly trusted TLS certificates must have a lifespan of 398 days or less. According to security experts, since many organizations lack the automation capabilities necessary to replace certificates with short lifespans at machine scale and speed, they are likely to see sharp increases in outages caused by unexpected certificate expirations. Since digital keys and certificates control the flow of sensitive data to trusted machines in a wide range of security and operational systems, when these certificates expire unexpectedly, the machines or applications they identify will cease to communicate with other machines, shutting down critical business processes.

See the full report here: https://www.helpnetsecurity.com/2020/09/02/reduced-lifespan-of-tls-certificates-could-cause-increase-in-outages/

Over 400 GOV.UK domains found on spam blacklists - BleepingComputer

Hundreds of domains managed by the U.K. government were found on DNS-based blacklists after a GitHub user compiled a list of 8,481 GOV[.]UK domains and found that nearly 450 of them were on one or more DNSBLs. The Domain Name System-based Blackhole List (DNSBL) is a decentralized system with different servers around the world keeping tabs on IPs spamming email users. Having a domain on a DNSBL may prevent legitimate emails from being delivered correctly. For example, the recipient's mail provider may lookup a DNSBL and move your sent mail to the recipient's spam folder. Further, more problems may arise when even one offending user abuse the shared services for spamming users. Being on the same server, this would impact all other clients sharing that IP, should the IP now be added to a blacklist. Ultimately, this can impact an organization's reputation in addition to causing problems with email delivery.

See the full report here: https://www.bleepingcomputer.com/news/security/over-400-govuk-domains-found-on-spam-blacklists/

Joker Spyware Plagues More Google Play Apps

Google has deleted six apps from its Google Play marketplace that were infecting users with the Joker malware. Joker is a billing-fraud family of malware that merged in 2017 but began to ramp up in 2019. It advertises itself as a legitimate app, but once installed, simulates clicks and intercepts SMS messages to subscribe victims to unwanted, paid premium services. The malicious apps are riddled with permission requests and submitted to Google Play by their developers. They get approved, published, and installed by users. Once running on users’ devices, they automatically download malicious code. Then, they leverage their numerous permissions to execute the malicious code. The apps found with malware included Convenient Scanner 2, Separate Doc Scanner, Safety AppLock, Push Message-Texting & SMS, Emoji Wallpaper, and Fingertip GameBox.

See the full report here: https://threatpost.com/joker-spyware-google-play-apps-2/158895/

New Intel microcode updates for Windows 10 fix CPU hardware bugs - BleepingComputer

Microsoft has released a new batch of Intel microcode updates for Windows 10 2004, 1909, 1903, and older versions to fix hardware bugs in Intel CPUs. When Intel finds bugs in their CPUs, they release microcode updates that allow operating systems to patch the behavior of the CPU to fix, or at least mitigate, the bug. Intel Microcode updates are not installed via Windows Update and Windows users need to install manually.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/new-intel-microcode-updates-for-windows-10-fix-cpu-hardware-bugs/

Hackers actively exploiting severe bug in over 300K WordPress sites - BleepingComputer

Hackers are actively exploiting a critical remote code execution vulnerability allowing unauthenticated attackers to upload scripts and execute arbitrary code on WordPress sites running vulnerable File Manager plugin versions. The File Manager plugin is currently installed on more than 700,000 WordPress sites and the vulnerability impacts all versions between 6.0 and 6.8. The hackers are trying to upload PHP files with webshells concealed within images to the wp-content/plugins/wp-file-manager/lib/files/ folder. They are also attempting to upload a malicious hardfork.php script which allows them to inject malicious code within the WordPress sites' /wp-admin/admin-ajax.php and /wp-includes/user.php scripts. The interesting feature of these attacks is that hackers are trying to prevent others from compromising an already infected site by password protecting the files exposed to writing by the File Manager vulnerability. File Manager's dev team released File Manager 6.9 to mitigate this issue.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-actively-exploiting-severe-bug-in-over-300k-wordpress-sites/

Backdoors left unpatched in MoFi routers

Canadian networking gear vendor MoFi Network has patched only six of ten vulnerabilities that have been reported to the company in May. Unpatched vulnerabilities include a command injection vulnerability and three hard-coded undocumented backdoor mechanisms, all impacting the company's line of MOFI4500-4GXeLTE routers. These routers provide high bandwidth connections to business users via LTE (4G) uplinks and are deployed to ensure internet access to remote business points where normal wired internet connections aren't available. According to CRITICALSTART researchers, the vulnerabilities only requires that an attacker have a direct line to the device's web management interface that is accessible by default on all network interfaces via both LAN and WAN. Although some of the devices prevent direct access to the management interface from the Internet, the vulnerability can also be triggered indirectly by a user clicking a link or visiting a malicious web site.

See the full report here: https://www.zdnet.com/article/backdoors-left-unpatched-in-mofi-routers/

Epic Fail: Emotet malware uses fake ‘Windows 10 Mobile’ attachments - BleepingComputer

The Emotet malware is now using malicious email attachment that pretends to be made by Windows 10 Mobile, an operating system that reached the end of life in January 2020. The Emotet botnet spreads through spam emails with malicious Word documents containing malicious macros that will download and install Emotet on a victim's computer when enabled. Once installed, Emotet will steal a victim's email to use in additional spam campaigns and download and install other malware such as TrickBot and QBot, which commonly lead to network-wide ransomware attacks. In a recent update to the malicious Word documents, Emotet tracking group Cryptolaemus have discovered that a new document template is being used that pretends to be created on Windows 10 Mobile. The operation did not succeed because the file was created on Windows 10 Mobile device. If you receive an email with a Word document stating it was made in Windows 10 Mobile, do not enable editing or content, and immediately trash it.

See the full report here: https://www.bleepingcomputer.com/news/security/epic-fail-emotet-malware-uses-fake-windows-10-mobile-attachments/

Google removes Android app that was used to spy on Belarusian protesters

Google has removed an Android app named NEXTA LIVE (com[.]moonfair[.]wlkm) from the Play Store that was used to collect personal information from Belarusians attending anti-government protests. NEXTA LIVE claimed to be the official Android app for Nexta, an independent Belarusian news agency that gained popularity with anti-Lukashenko protesters after exposing abuses and police brutality during the country's recent anti-government demonstrations. However, in a statement published on Telegram, Nexta stated that the app was not associated with its service and was designed to collect data from users and de-anonymize protest-goers. Nexta also asked users to immediately uninstall the app from their devices, give the app a bad rating and review, and then report it to Google staff.

See the full report here: https://www.zdnet.com/article/google-removes-android-app-that-was-used-to-spy-on-belarusian-protesters/

'KryptoCibule' Uses Several Tricks to Maximize Cryptocurrency Theft

Security researchers at ESET have discovered a new strain of malware dubbed "KryptoCibule" that uses multiple techniques to evade detection while maximizing cryptocurrency theft by targeting victims in the Czech Republic and Slovakia. KryptoCibule is a triple threat- it uses a victim's resources to mine virtual coins, tries to hijack transactions by replacing the wallet address in the clipboard, and exfiltrates cryptocurrency-related files, all while employing techniques to evade detection. KryptoCibule is distributed via malicious torrents for ZIP files disguised as installers for pirated games and software. When users install, they get the expected software as well as the malware. Attackers rely on the BitTorrent protocol to spread to new victims and download additional tools and updates to KryptoCibule once it's installed. The latest versions of the malware employ XMRig, an open-source program designed to mine Monero using the device's CPU, and kawpowminer, another open-source program that mines Ethereum using the GPU. Both programs connect to an attacker-controlled mining server over the Tor proxy.

See the full report here: https://www.darkreading.com/threat-intelligence/kryptocibule-uses-several-tricks-to-maximize-cryptocurrency-theft/d/d-id/1338822

Cisco fixes critical code execution bug in Jabber for Windows - BleepingComputer

Cisco addressed a critical severity remote code execution vulnerability affecting multiple versions of Cisco Jabber for Windows. The security flaw, tracked as CVE-2020-3495, can allow authenticated, remote attackers to execute arbitrary code on systems running all currently supported versions of the Windows Cisco Jabber client. A successful exploit could allow the attacker to cause the application to execute arbitrary programs on the targeted system with the privileges of the user account that is running the software. No user interaction is required to exploit this flaw and can also be exploitable when the Jabber for Windows client is running in the background. Cisco Jabber users are recommended to apply the fix.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-fixes-critical-code-execution-bug-in-jabber-for-windows/

Microsoft Defender can ironically be used to download malware - BleepingComputer

A recent update to Windows 10's Microsoft Defender antivirus solution allows it to download malware and other files to a Windows computer. With this new feature, local attackers can abuse Microsoft Defender's command-line tool. The update includes a new "-DownloadFile" command-line argument. This directive allows a local user to use the Microsoft Antimalware Service Command Line Utility (MpCmdRun.exe) to download a file from a remote location. Microsoft Defender will detect malicious files downloaded with MpCmdRun.exe, but it is unknown if other AV software will allow this program to bypass their detections.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-can-ironically-be-used-to-download-malware/